Most of the Windows PCs and servers in your business use Secure Boot, a feature that checks the software loading as the computer starts has not been tampered with. It relies on a set of Microsoft certificates issued in 2011, and those certificates are now reaching the end of their life.
The dates
Late June 2026: the Microsoft Corporation KEK CA 2011 and the Microsoft UEFI CA 2011 expire.
October 2026: the Microsoft Windows Production PCA 2011, which signs the Windows boot manager itself, expires.
Microsoft has issued replacement certificates (dated 2023) and has been rolling them out through Windows Update and through manufacturers’ firmware updates.
Will my computers stop working?
No. Devices still running the old certificates will carry on starting up normally. The problem comes afterwards: a device that has not received the new certificates cannot receive new boot-level security fixes, including updates to the Windows boot manager and the list of known-bad software that Secure Boot blocks.
That matters because boot-level malware (“bootkits”) is designed to load before Windows and before your antivirus. Secure Boot is the defence against it, and a Secure Boot that cannot be updated slowly stops doing its job.
Which devices need attention
Supported Windows 11 and Windows Server devices receiving Microsoft’s updates should get the new certificates automatically, but only if updates are managed and actually being installed.
Older PCs and servers may need a firmware (BIOS or UEFI) update from the manufacturer before they can accept the new certificates. Some will never get one.
Windows 10 devices outside Microsoft’s Extended Security Updates programme will not receive the new certificates. If you still have them, this is one more reason to replace them (see our Windows 10 end of support guide).
Virtual machines with Secure Boot turned on need the same treatment as physical ones.
Linux and dual-boot systems that rely on the Microsoft UEFI CA to start may also be affected.
What to do now
Make sure Windows updates are being installed, on every device, including the ones in the comms cupboard.
Check firmware on PCs and servers more than a few years old, and apply the manufacturer’s latest update where there is one.
Find the devices that cannot be updated, and plan to replace them.
Check, do not assume. A device can look up to date and still be using the old certificates. Your IT provider can report on Secure Boot status across the estate.
How we can help
For our managed IT clients, keeping devices patched and firmware current is part of the service. If you are not sure where your business stands, our IT health check will tell you which devices need attention and which need replacing. Talk to us or call 01642 661888.