Windows Secure Boot: 2011 certificates expire in 2026, 2023 CA certificates needed
Summary
Microsoft is replacing the Secure Boot certificates from 2011 with 2023 versions. The old certificates expire between June and October 2026. Devices without the new certificates keep starting and receiving normal Windows updates, but can no longer receive new boot-level security protections. Microsoft states that it manages the update automatically on many devices.
What changes?
Devices without the 2023 certificates continue to start and operate normally. They cannot receive updates to Windows Boot Manager, Secure Boot databases (DB, DBX) or revocation lists, or mitigations for new boot-level vulnerabilities. Scenarios that rely on Secure Boot trust, such as BitLocker hardening or third-party bootloaders, may be affected.
Affected
- Windows 10 (including version 22H2 and LTSC editions 2019/2021, IoT)
- Windows 11 versions 21H2, 22H2, 23H2, 24H2 (various editions)
- Windows Server 2012 ESU, 2012 R2 ESU, 2016, 2019, 2022, 2025
- Certificates: KEK CA 2011 (expires 2026-06-24), Microsoft UEFI CA 2011 (2026-06-27), Windows Production PCA 2011 (2026-10-19)
- Reference: KB5062710
Preparation and temporary exceptions
- Update both the UEFI Secure Boot KEK and DB with the corresponding 2023 certificates (Microsoft Corporation KEK 2K CA 2023, Windows UEFI CA 2023, Microsoft UEFI CA 2023, Microsoft Option ROM UEFI CA 2023).
- Install available OEM firmware updates where needed.
- Organisations that manage their own updates: follow the Microsoft guidance for the device type.
Check and complete
Microsoft manages the certificate update on a significant portion of Windows devices. Verify on each device that the 2023 certificates are present, see KB5062710.
Recommendation
Inventory your devices, check which already carry the 2023 certificates, and install current Windows and OEM firmware updates. Plan manual updates for managed devices, servers and virtual machines, and test critical systems first. Note that the Windows Production PCA 2011 expiry date (2026-10-19) has already passed as of today; check any devices still without the new certificate.
Timeline
- Microsoft Corporation KEK CA 2011 expires (replacement: Microsoft Corporation KEK 2K CA 2023).
- Microsoft UEFI CA 2011 expires (replacements: Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023).
- Microsoft Windows Production PCA 2011 expires (replacement: Windows UEFI CA 2023).
Sources
- Windows Secure Boot certificate expiration and CA updates (KB5062710) Vendor · support.microsoft.com
- Windows Secure Boot Key Creation and Management Guidance Vendor · learn.microsoft.com
Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 17:16.
Where the information comes from
We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:
- Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
- other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
- community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
- targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
- early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online
Summary and translation with AI (Claude by Anthropic) – without any data of visitors.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.