Windows Secure Boot Certificate Expiry 2026

Microsoft's original Secure Boot certificates, issued in 2011, expire during 2026. As of late September 2026, two of the three expiry dates have already passed and the last one is less than a month away.

The good news is that expiry does not brick devices. Microsoft states that a device continues to start normally and standard Windows updates continue to install. The bad news is that a device without the 2023 certificates can no longer receive new security protections for the early boot process.

For an SME, this is an inventory and evidence job: know which devices have the new certificates, fix the ones that do not, and escalate hardware that needs a firmware update.

Quick answer

1. Confirm the expiry dates: KEK CA 2011 on 24 June 2026, UEFI CA 2011 on 27 June 2026, and Windows Production PCA 2011 on 19 October 2026.
2. Check the UEFICA2023Status registry value and event IDs 1801 and 1808 on each device.
3. Let Microsoft-managed updates cover what they can, and deploy the update yourself on devices you manage tightly.
4. Allow around 48 hours and one or more restarts for certificates to apply.
5. Check OEM firmware for devices that fail, especially older models still in support.
6. Do not disable Secure Boot as a workaround.

Which certificates expire, and when

Microsoft's support article on Secure Boot certificate expiration lists the following:

The UEFI CA 2011 is being replaced by two certificates, separating third-party boot loaders from option ROMs. Microsoft notes that many Windows PCs manufactured since 2024 already have the 2023 certificates.

What actually happens after expiry

Microsoft published a support note on 10 February 2026 explaining the practical effect. The device keeps booting and Windows keeps updating. What stops is the ability to receive new Secure Boot and Boot Manager protections, updates to the Secure Boot databases and revocation lists, and fixes for newly discovered vulnerabilities in the early boot environment.

Microsoft describes such devices as becoming progressively less protected, and flags BitLocker hardening and third-party boot loader scenarios as areas affected over time. It also advises against disabling Secure Boot to work around problems.

That matters for Cyber Essentials Plus endpoint checks. A device that cannot receive boot-chain security updates is hard to describe as fully patched, even if Windows Update shows green.

How to check a device

Microsoft's IT professional guidance gives three signals to use:

• Registry: the UEFICA2023Status value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing.
• Event ID 1808: informational, confirming the certificates have been applied to firmware.
• Event ID 1801: an error indicating the certificates have not been applied.

Microsoft also references the Get-SecureBootUEFI PowerShell cmdlet with the -Decoded parameter for reading the Secure Boot databases directly.

For a small estate, an Intune remediation script that reads the registry value and reports the result is the simplest route. It gives you a device list you can sort by model, which is what you need when you start talking to OEMs.

How to update devices

Microsoft says it manages the certificate update automatically on a significant portion of Windows devices. For organisations managing their own updates, Microsoft documents several deployment methods: registry keys, Group Policy, the Windows Configuration System (WinCS), and Intune or Configuration Manager using PowerShell scripts. Microsoft notes that a dedicated Intune CSP is coming in a future update.

Two details from Microsoft's guidance are easy to miss:

• The Microsoft-managed Controlled Feature Rollout assistance requires Windows diagnostic data. If you have restricted diagnostic data, do not assume Microsoft is handling it for you.
• Microsoft suggests estimating 48 hours and one or more restarts for certificates to apply after a device is selected.

Test on a representative sample first. Pick one of each hardware model you own, confirm event 1808 appears, confirm BitLocker behaves normally after restart, and only then widen the deployment. If you are already running a 14-day patch evidence process, add the Secure Boot status report to it.

The firmware and OEM angle

Some devices will not take the update through Windows alone. Microsoft advises checking with your device manufacturer for firmware updates, particularly where a device is still within its support period, and says many OEMs provide firmware updates when needed.

For SMEs, the practical split is:

1. Devices showing event 1808: record and move on.
2. Devices showing event 1801 on a supported model: apply the latest BIOS or UEFI firmware from the OEM, then retry.
3. Devices out of OEM support that still fail: treat them as replacement candidates, in the same way you handled Windows 10 end of support.

Source basis

• Microsoft Support: Windows Secure Boot certificate expiration and CA updates
• Microsoft Support: When Secure Boot certificates expire on Windows devices
• Microsoft Support: Secure Boot certificate updates, guidance for IT professionals and organizations