Secure Boot Certificates 2026: Check for the 2023 Certificates

Short answer: Three Microsoft Secure Boot certificates from 2011 expired in 2026: the KEK CA 2011 on June 24, the UEFI CA 2011 on June 27 and the Windows Production PCA 2011 on October 19. Microsoft says PCs without the 2023 replacements keep starting and keep getting normal Windows updates, but stop receiving new boot-level protections such as boot manager and revocation list (DBX) updates. Most PCs get the new certificates automatically through Windows Update. To check yours, open Windows Security > Device security > Secure Boot, or read UEFICA2023Status in the registry: Updated means the update finished. If it is stuck, install the latest BIOS from your PC maker and leave Secure Boot on.

Official-source review — 24 October 2026 UTC: We checked Microsoft’s KB5062710 (Windows Secure Boot certificate expiration and CA updates), KB5068202 (registry keys for Secure Boot), KB5087130 (status in the Windows Security app), KB5084464 (the High Confidence database), Microsoft’s index of OEM Secure Boot pages, Dell’s article 000347876, ASUS FAQ 1055903, Lenovo Press LP2353 and Red Hat’s guidance for Linux. We did not run the administrator Get-SecureBootUEFI check, change any Secure Boot setting or update any firmware. On our own Lenovo test laptop we read the Secure Boot servicing values from the registry without admin rights; the results are below.

Which Secure Boot certificates expire in 2026

Secure Boot only lets your PC start code signed by certificates stored in the firmware, and most PCs have trusted the same 2011 Microsoft certificates since the Windows 8 era. KB5062710 lists the replacements. The UEFI CA 2011 is split in two, so a PC can trust add-in card firmware (option ROMs) without trusting third-party boot loaders.

As of today, all three dates have passed. The last one, the certificate that signs the Windows boot loader, expired five days ago.

What happens if your PC still has the 2011 certificates

Your PC will not suddenly refuse to start. Microsoft says devices without the 2023 certificates “will continue to start and operate normally”, and standard Windows updates keep installing.

What stops is protection for the earliest stage of startup: no more Windows Boot Manager updates, Secure Boot database and revocation list updates, or fixes for new boot-level vulnerabilities. Microsoft adds that this may affect BitLocker hardening and third-party boot loaders over time. Dell’s article 000347876 says the same.

What Windows Update does for you

KB5062710 says most Windows devices will receive the updated certificates automatically. The rollout is staged. Microsoft’s High Confidence database article (KB5084464) explains that Windows uses a signed database included in cumulative updates to sort each device into a group, and only pushes certificates to devices the data says can take them. “High Confidence” means devices of that type have been shown to update successfully; the other groups are Under Observation, Temporarily Paused, Not Supported and No Data Observed. Some PCs also need a firmware update from the manufacturer first.

How to check whether your PC has the 2023 certificates

1. Windows Security (easiest)

Since April 2026, the Windows Security app shows certificate status under Device security > Secure Boot, according to KB5087130. Green “Fully updated” means all required certificates and the updated Boot Manager are installed. Yellow “Not yet updated” means Windows Update should still deliver it. Red “Requires action” means a boot security update cannot be delivered, and Microsoft points you to aka.ms/getsecureboot. Read the text, not just the colour, and don’t dismiss a warning on a PC that isn’t updated.

2. Registry check (no admin rights needed)

Microsoft documents the status values under HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing in KB5068202. Open PowerShell normally and run:

Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing' |
  Select-Object UEFICA2023Status, UEFICA2023Error, WindowsUEFICA2023Capable, ConfidenceLevel

3. Firmware check (admin)

To read the certificate database directly, open PowerShell as administrator. This is the check ASUS and Lenovo publish; each line prints True if that certificate is present:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Microsoft UEFI CA 2023'
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI KEK).bytes) -match 'Microsoft Corporation KEK 2K CA 2023'

What we found on our own test laptop

On 24 October 2026 UTC we read the registry on a Lenovo laptop (model 82WK, BIOS KWCN54WW dated 2025-10-22) running Windows 11 Home build 26300, with UEFISecureBootEnabled = 1 under ...\SecureBoot\State. Under ...\SecureBoot\Servicing we saw:

• UEFICA2023Status = Updated: by Microsoft’s definition, the update completed.
• WindowsUEFICA2023Capable = 2: Windows UEFI CA 2023 is in the DB and the PC starts from the 2023-signed boot manager. Microsoft calls this value reference-only.
• ConfidenceLevel = High Confidence: the device type is in the group Microsoft has seen update successfully.
• RebootRequestedDB = 1: this value is not documented in any Microsoft article we read, so we are not guessing what it means.

We did not run the admin Get-SecureBootUEFI check, so we did not confirm the KEK certificate directly. That is one laptop, not a test of every Lenovo model.

What to do if your PC is not updated

1. Install all Windows updates and restart. ASUS says the OS should be at build 26100.6725 or later before you check the keys.
2. Update the BIOS/UEFI from your PC maker’s own support site. Dell says all its client BIOS versions released after 1 January 2026 include the 2023 certificates; its BIOS notes say “This BIOS contains the new 2023 Secure Boot Certificates”. ASUS says some systems need a firmware update and asks you to contact an ASUS service centre for Event ID 1802 or 1803. Microsoft keeps a list of every PC maker’s Secure Boot page, including HP, Lenovo, Acer, MSI and Surface.
3. Back up your BitLocker recovery key before a firmware update. Lenovo lists this as a step before updating.
4. Keep Secure Boot on. ASUS warns that with Secure Boot off the PC won’t receive the new certificates.
5. Don’t reset firmware keys to factory defaults on a PC already starting from the 2023 boot manager if the firmware itself lacks Windows UEFI CA 2023. ASUS warns Secure Boot may then block startup.

What this does not mean

An expired certificate is not malware and not a reason to buy a new PC. It is separate from the Windows 11 hardware requirements and from why 26H2 may not be showing. Turning Secure Boot off does not fix it, and no third-party “certificate fixer” is needed: Windows Update and your PC maker’s firmware are the official routes.

Linux, dual boot and USB boot media

Linux boot loaders (shim) are signed with the Microsoft UEFI CA. Red Hat says existing systems with the current shim keep booting after the expiry, because it only affects signing new files, not booting existing ones. The risk is later: shim updates signed only with the 2023 key boot only where the 2023 certificate is enrolled, so a PC that never gets the firmware update may struggle with future installs. Red Hat also warns that a DB update changes TPM PCR7, which matters if disk encryption is bound to it.

Lenovo notes that recovery, WinPE and installation media created before the 2023 boot manager “may fail to boot on updated firmware”. If you build boot USBs, keep Ventoy or Rufus and your ISOs current (see is Ventoy safe and Ventoy vs Rufus vs balenaEtcher); we have not tested these tools against the new certificates. Dual-booting a distro like those in Bazzite vs SteamOS? Update both the distro and the BIOS. On an unsupported PC or when weighing alternatives for an old PC, check whether the maker still publishes BIOS updates.

Questions

Will my PC stop booting because of the Secure Boot certificate expiration?

No. Microsoft says PCs without the 2023 certificates continue to start and receive standard Windows updates. They lose new boot-level security fixes.

What does UEFICA2023Status = Updated mean?

According to KB5068202, Updated is the success state: the 2023 certificates and new boot manager are in place. NotStarted or InProgress means it has not finished.

Do I need to set AvailableUpdates myself?

Microsoft documents it for IT-managed devices. On a home PC, Windows Update handles the rollout; check status first and update your BIOS if the update is blocked.

Does this affect Windows 10?

Yes. Microsoft’s Windows Security status article (KB5087130) applies to both Windows 10 and Windows 11, and the same Secure Boot check works on both.

Sources

• Microsoft KB5062710: Windows Secure Boot certificate expiration and CA updates
• Microsoft KB5068202: Registry key updates for Secure Boot (IT-managed updates)
• Microsoft KB5087130: Secure Boot certificate update status in the Windows Security app
• Microsoft KB5084464: A closer look at the High Confidence database
• Microsoft: OEM pages for Secure Boot
• Dell 000347876: Microsoft 2011 Secure Boot certificate expiration
• ASUS FAQ 1055903: Windows Secure Boot certificate expiration and certificate updates
• Lenovo Press LP2353: Updating Windows Boot Manager and WinPE with the Windows UEFI CA 2023 certificate
• Red Hat: Secure Boot certificate changes in 2026, guidance for RHEL