Microsoft's Last 2011 Secure Boot Certificate Expired on October 19: How to Check Your PC
PCs without the 2023 replacement keep booting and getting Windows updates, but stop receiving new early-boot protections.
The Microsoft Windows Production PCA 2011 certificate, which signs the Windows boot loader, expired on October 19, 2026. It is the last of three original Secure Boot certificates Microsoft has been replacing this year. PCs that have not received its 2023 successor keep working, but stop receiving new protection for the earliest stage of startup (Windows Latest, PCWorld).
What expired and what replaces it
| 2011 certificate | Role | Expired | Replacement |
|---|---|---|---|
| Microsoft Corporation KEK CA 2011 | Key exchange key | June 24, 2026 | 2023 KEK |
| Microsoft UEFI CA 2011 | Third-party boot loaders and option ROMs | June 27, 2026 | 2023 UEFI CA |
| Windows Production PCA 2011 | Signs the Windows boot loader (stored in the Secure Boot database) | October 19, 2026 | Windows UEFI CA 2023 |
The University of Wisconsin knowledge base, which mirrors Microsoft's dates, notes the issue applies only to devices using UEFI with Secure Boot turned on.
Your PC will not stop booting
The expiry is not a kill switch. Microsoft says devices without the 2023 certificates still start and run normally, and standard monthly Windows updates keep installing. What stops is protection before Windows loads: such a PC can no longer get Boot Manager updates, Secure Boot database and revocation list updates, or mitigations for newly found boot-level vulnerabilities.
The risk is gradual. Protection against emerging threats weakens over time, and features that lean on Secure Boot trust, including BitLocker hardening and third-party bootloaders, may be affected. Bootkits such as BlackLotus are the sort of threat revocation updates are meant to block. A machine on the old certificate is not suddenly vulnerable, but it falls further behind every time the boot chain is tightened.
How to check your own machine
- Open Windows Security, go to Device security and look at the Secure Boot entry. A "Requires action" warning means the PC still relies on an expired certificate. Microsoft treats a PC as fully updated only when it has both the 2023 certificates and the new boot manager.
- Keep Windows Update running. Microsoft says it will continue delivering the new certificates to eligible devices through Windows Update, in phases grouped by hardware and firmware (Microsoft KB5127648 notes).
- If the warning persists, check your PC maker's support page (Dell, HP, Lenovo, Asus, Acer) for a firmware/BIOS update. Some older machines need one, and makers may only offer it during a device's support period.
What not to do
Do not switch Secure Boot off as a workaround. It removes protection against boot-level malware, and turning it back on later can leave a PC unable to start if its firmware trusts only the 2011 certificate. Back up your BitLocker recovery key before applying any BIOS update, because some firmware updates have pushed machines into recovery prompts (MakeUseOf).
Windows 10 PCs receive the new certificates only through Extended Security Updates, so unsupported Windows 10 machines are the most likely to be left on the old chain.
Why this matters in India
Many Indian households and small businesses run Windows PCs well past their warranty, often bought from local assemblers or refurbished channels. Those are the machines most likely to need a manufacturer firmware update and least likely to get one, so owners should check the Secure Boot status now and note the make and model in case a BIOS update is needed.
What to watch next
How quickly Microsoft's phased rollout reaches remaining devices, firmware updates from major PC makers, and any Microsoft date for enforcing revocation of the 2011 certificate.
