Windows Secure Boot certificates: what to check in June 2026
Two 2011 Secure Boot certificates are due to expire in June 2026, with another in October. Learn what the dates mean, where to check your PC's update status, and when to contact its manufacturer.
4 min read
- Author
-
-
- Published
- Reading time
- 4 min
24 June 2026 is not a Windows shutdown date. Microsoft lists Secure Boot certificates issued in 2011 that expire on different dates: two in June and a Windows boot-loader certificate in October. Most personal Windows PCs receive the replacement certificates through Windows Update. A PC that still has the older trust data should continue to start and receive routine Windows updates, but it can miss future protection for the early-boot process. Check the certificate status in Windows Security; do not disable Secure Boot or edit firmware keys because of the deadline.
What is expiring
Secure Boot is part of UEFI startup. Before Windows loads, the PC checks whether boot software is trusted using certificates and signature databases stored in firmware. Microsoft is replacing older trust material with 2023 certificates. The date list below is Microsoft's published schedule, updated on 18 May 2026; see Microsoft's certificate table for the exact names and replacement roles.
- 24 June — Microsoft Corporation KEK CA 2011. The replacement is Microsoft Corporation KEK 2K CA 2023. The KEK signs updates to the Secure Boot signature databases.
- 27 June — Microsoft UEFI CA 2011. The renewal separates trust for third-party boot loaders and EFI apps (Microsoft UEFI CA 2023) from trust for Option ROMs (Microsoft Option ROM UEFI CA 2023).
- 19 October — Microsoft Windows Production PCA 2011. Windows UEFI CA 2023 replaces it for signing the Windows boot loader.
These are firmware trust certificates, not your Microsoft account, Windows licence or a date when the operating system stops working. If an older certificate remains after its expiry, the PC can still start and standard Windows updates can continue. Over time, however, it may not receive new protections for early-boot components, such as Windows Boot Manager updates, revocation lists or fixes for newly found boot-chain vulnerabilities. Some software that relies on Secure Boot trust can also be affected.
Check the update status in Windows
On supported personal Windows 10 and Windows 11 PCs where the feature has rolled out, open Windows Security > Device security > Secure Boot. Microsoft began adding certificate status there in April 2026, with updates rolling out through the app and monthly Windows updates. You may not see the new status on every device yet. Microsoft documents the labels in its Windows Security status guidance .
Read the status text, not just the icon. Microsoft says a green checkmark by itself does not prove that the new certificates have been applied.
- If the message says “Secure Boot is on and all required certificate updates have been applied. No further certificate changes are needed,” no certificate change is needed.
- If it says your device is using an older boot trust configuration, install the latest Windows updates and restart if prompted. Keep the PC connected to the internet, then check the status again.
- If the status page is missing, treat the result as unknown; the feature is still rolling out. Its absence is not confirmation that the certificates are updated.
When to ask for help
Most personal devices receive the new certificates through Microsoft-managed updates. Some models need an OEM firmware update, and managed work or school PCs may be handled by IT. If Windows Security says your device has a hardware or firmware limitation, use the PC maker's guidance for that exact model. If the PC belongs to an organisation, ask its IT administrator before changing settings.
Do not turn Secure Boot off to work around the expiry, and do not clear or replace firmware keys using generic instructions. Microsoft says not to disable Secure Boot as a workaround ; use the supported certificate update instead. If you are reading this after June 2026, check Microsoft's current device-specific guidance before acting; the rollout and recommended next steps can change.
