The 2011 Secure Boot Certificates Have Expired: What Still Boots and What to Check

The last of Microsoft’s 2011 secure boot certificates expired on October 19, 2026. Microsoft’s KB5132953, published October 22, confirms it: the Microsoft Windows Production PCA 2011, which signed the Windows boot loader for 15 years, is done. The other two 2011 certificates ran out in June.

Nothing stopped booting. That is the good news, and it is also why this is easy to ignore. Microsoft says devices without the newer 2023 certificates keep starting and keep taking normal Windows updates. What they lose is new protection for the boot process itself, and future major Windows releases will not install on them.

The short version: check which of your PCs, servers and virtual machines have the 2023 secure boot certificates in firmware. Back up BitLocker recovery keys first. Look for OEM firmware updates on older models, review any App Control rules that name the old certificate, and rebuild old USB install media. Do it while the work is routine.

This post covers what expired, what still works, what stops, how to check a device, and a short checklist for a small IT team. All facts are from Microsoft’s own support pages as of early November 2026.

Which secure boot certificates expired, and when

Secure Boot is a firmware feature. When a PC starts, the firmware checks that the boot loader and other early code are signed by a certificate it trusts. Microsoft’s main certificate expiration page (KB5062710) lists the 2011 certificates and their 2023 replacements.

The DB is the firmware’s list of trusted signers. The DBX is its list of revoked ones. The KEK is the key that allows updates to both. Microsoft notes that the 2023 set splits third-party boot loaders and option ROMs into two certificates, so a system can trust one without the other.

We covered a similar rollover of a root of trust last month in our post on the root KSK rollover. The pattern is the same: the change happens upstream, and each organization has to confirm its own systems followed.

What still works after the expiration

Microsoft’s explainer for affected devices lists what keeps working on a device that never got the 2023 certificates:

• Normal startup
• Most Windows updates
• Apps, networking, browsing and most operating system features

KB5132953 adds that boot binaries already installed keep running. A device without the 2023 secure boot certificates keeps booting the last 2011-signed Windows Boot Manager.

So the expiration did not cause an outage. Help desks should not expect a wave of dead machines from it.

What stops: boot fixes and future Windows releases

The losses are slower but real. According to KB5132953, Microsoft no longer signs any binary or security catalog with PCA 2011 as of October 19. The last 2011-signed Boot Manager builds are frozen. They get no more code changes or security fixes.

That means a device still on the 2011 chain:

• Gets no new Boot Manager fixes
• Gets no new Secure Boot database or revocation list updates
• Gets no fixes for new boot-chain flaws, which Microsoft says can include BitLocker bypass mitigations

The bigger date to plan for is the next major Windows release. KB5132953 says future major releases will carry only 2023-signed boot files. They will need the Windows UEFI CA 2023 certificate in the firmware DB to boot install media and finish setup. Microsoft has not given a date for that release as of early November 2026.

Microsoft’s FAQ also says only supported Windows versions get the new certificates. A Windows 10 PC outside the Extended Security Updates program will not get them. If you still run a version that has left servicing, such as the editions in our Windows 11 23H2 end of servicing post, plan the upgrade first.

How to check a device for the 2023 secure boot certificates

There are three ways to check, from easiest to most scalable.

The Windows Security app. Microsoft’s status page says to open Windows Security, then Device security, then Secure Boot. The status reads "Fully updated," "Not yet updated" or "Requires action." This works on Windows 11, Windows 10, and Windows Server 2019, 2022 and 2025. On enterprise-managed devices, the badges and pop-up alerts are off by default, but the status text still shows.

PowerShell and the registry. Microsoft’s IT guidance starts with Confirm-SecureBootUEFI in an elevated PowerShell window. It returns True when Secure Boot is on. The guidance then reads values under HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing, including UEFICA2023Status. Its sample output shows "Updated" for a finished device.

Event logs. The same guidance names two System events to watch:

• Event 1801, an error: the updated certificates have not been applied.
• Event 1808, informational: the device has the new certificates in firmware.

Microsoft’s guidance says to start with a sample of devices grouped by maker, model and BIOS version, and to test four or more of each. It also says to "Estimate 48 hours and one or more restarts for the certificates to apply."

If Secure Boot is off on a device, none of this applies. Microsoft’s FAQ says those devices do not get the new certificates and remain open to bootkits.

Microsoft-managed vs IT-managed devices

Microsoft’s FAQ says the 2023 secure boot certificates shipped in the May 13, 2025 cumulative updates and later. Installing the update does not write them to firmware by itself.

On devices where Microsoft manages updates and diagnostic data is on, Microsoft attempts the update for you. The FAQ is clear that this is help, not a promise, and that IT administrators stay responsible for the fleet.

On IT-managed devices, the IT guidance lists the deployment options: registry keys, the WinCS command line tool, and Intune or Configuration Manager scripts. Group Policy and an Intune setting are listed as planned. Microsoft advises against mixing methods on one device.

The IT guidance flags newer hardware too. Devices made in the past year or two may already have the 2023 certificates but still need the 2023-signed Boot Manager, which Microsoft calls a critical last step.

Older hardware and OEM firmware

Some devices need a firmware update before the new secure boot certificates will apply. Microsoft’s IT guidance tells admins to check with the device maker, and to pay attention to models the maker no longer supports. Its explainer warns that OEM firmware updates may only be available while a device is still in its support period.

Firmware matters for a second reason. Microsoft’s FAQ describes a device that stopped booting after a firmware reset. Windows was using the 2023-signed Boot Manager, but the reset firmware defaults did not include the 2023 certificate, so Secure Boot blocked startup. The fix is to reapply the certificate using a recovery USB. Updated OEM firmware puts the 2023 certificates into the defaults and avoids this.

Microsoft is direct on one point: do not turn off Secure Boot as a workaround.

Virtual machines: Hyper-V, Azure and VMware

Virtual machines have virtual firmware, so they need the same secure boot certificates check. KB5132953 gives the platform rules:

• Hyper-V: Generation 2 VMs get the certificates through normal cumulative updates.
• Azure: Trusted Launch and Confidential VMs are updated through Azure platform servicing.
• VMware vSphere: update ESXi hosts and VM hardware versions to releases that include the 2023 certificates in the guest UEFI templates.

Long-running VMs can be updated through Windows if their virtual firmware supports Secure Boot updates. Our virtualization explainer covers how hosts and guests relate if your team is new to this.

BitLocker, App Control and old install media

App Control for Business. KB5132953 says App Control (WDAC) rules pinned to PCA 2011 may block updated Windows files. Signs include failed cumulative updates, services that fail at startup, and Code Integrity Event ID 3077. Microsoft recommends publisher rules over rules that pin a specific certificate or thumbprint, and testing changes in audit mode first. Ask your antivirus and endpoint vendors whether they have tested the 2023 certificates. Our endpoint security basics post covers where these tools sit.

Install media. KB5132953 says future Windows install media will boot with the 2023-signed boot loader by default. That media fails with a Secure Boot violation on hardware whose firmware lacks the 2023 certificate. To update older USB sticks and ISOs now, Microsoft offers the Make2023BootableMedia.ps1 script, described in KB5053484. It runs from an elevated PowerShell window and needs the Windows ADK.

A secure boot certificates checklist for a small IT team

1. Back up BitLocker recovery keys and confirm you can find them.
2. List devices by maker, model and BIOS version. Note which are past OEM support.
3. Check a sample in Windows Security, then confirm with UEFICA2023Status and Events 1801 and 1808.
4. Install OEM firmware updates where the maker offers them.
5. Pick one deployment method per device group and allow 48 hours and a restart.
6. Check Hyper-V, Azure and VMware guests, and update ESXi hosts if you run them.
7. Review App Control policies for rules that name PCA 2011.
8. Rebuild USB install media and keep one older copy for hardware that still needs it.
9. Plan replacements for devices that cannot take the 2023 secure boot certificates.

Certificates with fixed end dates are becoming a regular IT task. Our post on dual-use certificate deprecation covers another one on the calendar.

Frequently Asked Questions