Secure Boot certificates expired in 2026: how to check and update your PC

What expired and what replaces it

Secure Boot checks that the code loading before Windows is signed by someone your firmware trusts. Microsoft’s trust certificates from 2011 reached their end dates this year, and Microsoft lists their replacements as follows:

Certificate (2011)	Expired	Replacement (2023)	What it’s for
Microsoft Corporation KEK CA 2011	June 24, 2026	Microsoft Corporation KEK 2K CA 2023	Signs updates to the allowed and blocked lists (DB and DBX)
Microsoft UEFI CA 2011	June 27, 2026	Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023	Third-party boot loaders (such as Linux shim) and add-in card firmware
Microsoft Windows Production PCA 2011	October 19, 2026	Windows UEFI CA 2023	The Windows Boot Manager

The new certificates have to be written into the firmware’s Secure Boot databases, which is why the update can need a restart, and on some PCs a firmware update from the manufacturer.

What happens if your PC isn’t updated

Microsoft says a PC without the new certificates will still start and work normally and keeps receiving ordinary Windows updates. What it loses is new early-boot protection: updated Windows Boot Manager versions, additions to the list of blocked boot files, and fixes for future boot-level vulnerabilities. Microsoft also says it can affect BitLocker hardening and third-party boot loaders.

Microsoft is clear that turning Secure Boot off isn’t a workaround: it significantly reduces protection, and a PC with Secure Boot disabled won’t receive the certificates in firmware at all. Windows 10 PCs only get the update on a supported version, which in practice means enrolled in Extended Security Updates or running an LTSC edition. If your Windows 10 PC is out of support, see “Your version of Windows has reached the end of service”.

How to check your PC

1. Windows Security (easiest). Open Windows Security > Device security > Secure Boot. Microsoft added certificate status here in 2026, and the colour means:

Status	What Microsoft says it means	What to do
Green	Secure Boot is on and all required certificate updates are applied	Nothing
Yellow	Updates pending, paused for a known issue, not enough data yet, or not supported by the hardware or firmware	Read the message: install updates, wait, or contact the PC maker
Red (Requires action)	The PC can no longer receive required updates for the Windows boot experience	Follow the steps in the next section

Read the text under the icon, not just the colour. If Secure Boot itself shows as off, start with our guide to Secure Boot state.

2. PowerShell. On a PC with the April 2026 cumulative update or later, open Terminal (Admin) and run:

Get-SecureBootUEFI -Name db -Decoded

Look for an entry with the subject CN=Windows UEFI CA 2023. Many guides use an older one-line check that returns True or False:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

That shortcut only looks at one certificate in one database. Microsoft treats a PC as fully updated only when the new certificates and the new boot manager are both in place, so use the next check as well.

3. Registry status. Microsoft documents a status value Windows updates as it works:

Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing | Select-Object UEFICA2023Status, UEFICA2023Error

Updated with an error of 0 is what you want. NotStarted or InProgress means Windows hasn’t finished; restart and check again later.

4. Event Viewer. In Event Viewer > Windows Logs > System, filter on the source TPM-WMI. Event 1808 means the certificates and keys were updated. Event 1801 means the update is staged but not yet applied to firmware, which is normal partway through. Event 1802 means a known firmware issue blocked it, and 1795 means the firmware returned an error.

If the update hasn’t applied

1. Install every update and restart. Open Settings > Windows Update, install everything including optional cumulative updates, and restart. The process can take more than one restart; Windows re-tries on a scheduled task roughly every 12 hours.
2. Save your BitLocker recovery key first. A firmware change can make BitLocker ask for the key. Make sure you can find it before the next step; our guide to finding a BitLocker recovery key shows where it’s stored.
3. Update the BIOS/UEFI. Get the latest firmware from your PC or motherboard maker’s support page, especially after event 1802 or 1795, or a yellow status saying the hardware isn’t supported. Microsoft notes that some makers only provide this for devices still within their support period.
4. Don’t reset the firmware to defaults. On boards whose factory defaults only contain the 2011 certificates, a reset can undo the update. If a PC won’t boot after one, Microsoft’s FAQ advises creating Windows recovery media on another PC and booting from it.

If Windows shows Operating system loader failed signature verification at startup, that’s a related Secure Boot failure; see how to fix that error.

Things to watch for

• BitLocker recovery loops. Some users have reported repeated BitLocker key prompts after combined firmware and Secure Boot updates, mainly on certain HP business models, which later BIOS versions reportedly fixed. These are user reports, not a Microsoft known issue, but they’re a good reason to have your key ready.
• Old boot USB drives. Once Windows blocks the old 2011-signed boot manager, older Windows installation or recovery media may stop booting. Create fresh media with the Media Creation Tool or Rufus after your PC is updated.
• Linux dual boot. Red Hat says existing shim boot loaders keep working as long as either Microsoft certificate is in the firmware. Keep the distribution and its firmware tools (such as fwupd) updated so future shims signed only with the 2023 key still start.
• A new folder. A C:\Windows\SecureBoot folder may appear as part of the update. That’s expected; leave it alone.

For IT-managed PCs

On work devices, IT controls the rollout through Group Policy, Intune or registry values, and the Windows Security status badges are hidden by default. Microsoft’s IT guidance (KB5068202) documents setting AvailableUpdates to 0x5944 under HKLM\SYSTEM\CurrentControlSet\Control\Secureboot and running the \Microsoft\Windows\PI\Secure-Boot-Update task. Some older articles suggest a different value; use Microsoft’s current one, and only on a PC you manage.

Related guides

• Secure Boot state: how to check it and what On, Off and Unsupported mean
• Dell BitLocker recovery key: where to find it and why it appears
• Operating system loader failed signature verification: how to fix it
• Rufus Windows 10: how to make a bootable USB step by step

Official sources

• Windows Secure Boot certificate expiration and CA updates (Microsoft Support)
• Secure Boot certificate update status in the Windows Security app (Microsoft Support)
• Secure Boot DB and DBX variable update events (Microsoft Support)