The Secure Boot Certificate Saga: Why 2026 Matters for Your PC

By Tom Langston · 16 July 2026

Security
Windows
Secure Boot
Linux

TL;DR

Secure Boot, the feature that stops untrusted code loading when your PC starts up, relies on certificates stored in your firmware. The main ones were issued in 2011 and are expiring in 2026. If your PC does not receive the replacement 2023 certificates in time, it keeps booting fine, but it stops getting boot-level security updates, and older Linux or dual-boot setups can hit edge cases. The fix is mostly automatic through Windows Update, but it is worth understanding and checking your older machines.

Secure Boot only trusts code signed by certificates in your firmware. The 2011 certificates expire in 2026 (the first already lapsed on 27 June 2026, the Windows one expires on 19 October 2026).
Your PC needs the new 2023 certificates. Machines built from roughly 2024 often already have them.
Miss it and your PC still boots, it just stops receiving new Secure Boot security updates. A slow-burn risk, not an instant brick.
Linux and dual-boot: mostly fine, but old machines that cannot update their firmware can hit trouble when a bootloader needs re-signing.
Mostly handled by Windows Update, but check the stragglers: old, rarely-updated, or dual-boot machines.

Now for the more technical explanation

A quick recap: what Secure Boot is

Secure Boot is a UEFI (Unified Extensible Firmware Interface) firmware feature that ensures only code signed by trusted keys runs during startup, before Windows even loads. That is what blocks bootkits and rootkits, the nastiest malware, which try to load before the operating system so nothing can catch them. (It is one of the protections the antivirus vs EDR guide recommends turning on.)

The trust is anchored in certificates stored in your firmware’s key database. Microsoft’s certificates are the important ones, because Microsoft signs the Windows bootloader, and also, through a separate certificate authority, signs third-party bootloaders like the Linux “shim” that let Linux boot on the same Secure Boot machines.

The saga: the 2011 certificates expire in 2026

Those foundational certificates were issued in 2011 with roughly a fifteen-year life, and that clock is now running out:

Microsoft Corporation UEFI CA 2011 (signs third-party and Linux bootloaders): expired 27 June 2026.
Microsoft Windows Production PCA 2011 (signs the Windows bootloader itself): expires 19 October 2026.
Plus the Key Exchange Key (KEK) 2011 that authorises updates to the database.

Microsoft has issued replacement 2023 certificates, and the job is to get those enrolled into each machine’s firmware key database before the 2011 ones lapse.

What happens if the Secure Boot certificates expire?

Do not panic: your PC does not instantly brick. Bootloaders that are already trusted keep booting exactly as before. What you lose is the ability to receive new boot-level protections after expiry: updates to the Windows Boot Manager, refreshed Secure Boot databases, revocation lists, and mitigations for newly discovered boot-level vulnerabilities. It also stops trusting software signed with the new certificates.

So it is a slow erosion of your boot security, not a sudden failure. Over months and years, that is a genuine risk (unpatched boot-level holes), which is exactly why it is worth handling rather than ignoring.

Linux and dual-boot

The Linux impact is more limited than the scare headlines suggest:

A Linux system whose shim was signed under the 2011 UEFI CA will keep booting after June 2026. The expiry only stops signing new binaries, it does not stop running existing ones.
The edge cases are legacy machines: old laptops and desktops, appliances, and anything that never receives firmware or database updates. When such a machine eventually needs an updated shim or bootloader signed with the new certificate, it may refuse it, because the new certificate was never enrolled. Dual-boot setups on older hardware are where to pay attention.

What to do

Keep Windows Update current. Microsoft is rolling the 2023 certificate enrolment out through Windows Update, deliberately in a staged, careful way, because a mistake in the boot chain can brick a machine. Let it run.
Check newer machines are already sorted. PCs from roughly 2024 onward often ship with the 2023 certificates. You can see your Secure Boot status on the Device security page in Windows Security.
Watch the stragglers: old or rarely-updated PCs, virtual machines, and anything you dual-boot on older hardware. These are the ones that need a nudge (a vendor firmware update, or manual certificate enrolment in managed environments).
Back up your BitLocker recovery key first. The certificate roll-out is not meant to trigger it, but on some hardware the firmware change can prompt a one-off BitLocker recovery prompt, so make sure your recovery key is saved before it reaches that machine.
Businesses: treat it as a fleet task. Confirm each device’s status with Microsoft’s Detect-SecureBootCertUpdateStatus.ps1 PowerShell script, deploy the 2023 CAs before the expiries (through Windows Update, Group Policy, or Intune), test on representative hardware, and do not rush a change that touches the boot chain.

The bigger point

This whole episode is a neat reminder that trust in security has an expiry date, literally. The entire Secure Boot chain rests on certificates, and certificates expire. It is a rare, industry-wide rotation, handled mostly quietly by updates, but worth understanding so you are not caught out on the one old machine that slips through the cracks.

The short version

Secure Boot’s trust rests on 2011 Microsoft certificates that expire in 2026 (June and October). Your PC needs the replacement 2023 certificates, delivered through Windows Update. Miss it and nothing breaks immediately, but the machine stops getting boot-level security updates, and old dual-boot or Linux setups can hit edge cases when something needs re-signing. Keep updating, and check your older machines.

Written by Tom Langston, IT Infrastructure and Cybersecurity.