Secure Boot 2011 Certificates Expired: What It Means and How to Check Your PC
In 2026, Microsoft’s Secure Boot certificates issued back in 2011 expired. They are being replaced by new 2023 certificates. Your computer won’t stop booting because of this, but without the update it stops receiving important security fixes for the boot loader. Here’s what that means and how to check your PC in a couple of minutes.
What is Secure Boot?
Secure Boot is a UEFI (modern BIOS) feature that lets the computer start only boot loaders with a trusted digital signature. It blocks malware that tries to run before Windows starts (bootkits). The trust is based on certificates stored in the motherboard firmware.
Which certificates expired
| Certificate | What it’s for | Valid until |
|---|---|---|
| Microsoft Corporation KEK CA 2011 | Updating the lists of trusted and blocked boot loaders | June 24, 2026 |
| Microsoft Corporation UEFI CA 2011 | Third-party boot loaders (such as Linux) and drivers | June 27, 2026 |
| Microsoft Option ROM UEFI CA 2011 | Firmware of graphics cards and other expansion cards | June 27, 2026 |
| Microsoft Windows Production PCA 2011 | The Windows boot loader | October 19, 2026 |
They are replaced by 2023 certificates — for example, Windows UEFI CA 2023 and KEK 2K CA 2023.
What happens if you do nothing
- The computer keeps booting — no need to panic.
- But it stops receiving updates for the Windows Boot Manager and Secure Boot components. New boot loader vulnerabilities won’t be fixed on that PC.
How to get the new certificates
- Usually it happens automatically through Windows Update, as long as updates are on and Secure Boot is enabled. This applies to Windows 11 and to Windows 10 that still gets updates.
- Computers bought in 2024 or later usually came with the new certificates from the factory.
- Update your BIOS/UEFI from the laptop or motherboard maker’s website: many vendors add the 2023 certificates in new firmware. Keep in mind that very old models may no longer get firmware updates.
- On Windows Server and virtual machines, the certificates must be updated manually — they don’t arrive automatically.
How to check your computer
1. Is Secure Boot on? Press Win + R, type msinfo32 and look at “Secure Boot State” — it should say “On”. Or run this in PowerShell as administrator:
Confirm-SecureBootUEFI
True means Secure Boot is enabled.
2. Is the new Windows UEFI CA 2023 certificate installed? Open PowerShell as administrator and run:
$db = Get-SecureBootUEFI db -join [char[]]$db.bytes -match 'Windows UEFI CA 2023'
True means the new certificate is there. False means the computer still relies on the 2011 certificate.
3. Is the new KEK installed?
$kek = Get-SecureBootUEFI KEK -join [char[]]$kek.bytes -match 'KEK 2K CA 2023'
4. Event log. In Event Viewer (the System log), event ID 1808 means the device has received the new certificates and the updated boot manager. Event 1801 is informational: Windows has staged the update but hasn’t written it to the firmware yet. A couple of restarts is usually enough.
What to do if the certificates are missing
- Install all Windows updates and restart the computer once or twice.
- Update your BIOS/UEFI from the manufacturer’s website.
- Make sure Secure Boot is enabled in the UEFI settings.
- If you use Linux, update the system: new boot loaders are signed with the 2023 certificate. You don’t need to remove the old 2011 entries from the firmware.
For most home computers, it’s enough to keep Windows Update on and update the BIOS now and then — the rest happens automatically. If you’ve ever switched IDE to AHCI in UEFI, you’ll find the Secure Boot settings in the same place.
