This revised report explains Microsoft’s Windows Secure Boot Deadline Has Passed: What Users Should Check Now in a cleaner structure, retaining the original article’s core technical details and context.
An April 2026 warning said Microsoft Windows users had only eight weeks before an important upgrade deadline.
The issue was real, but the word “deadline” created confusion.
Microsoft’s Secure Boot certificates issued in 2011 began expiring in June 2026.
That does not mean affected PCs suddenly stopped working when the dates arrived.
Microsoft says devices without the replacement 2023 certificates can continue to start and receive standard Windows updates, but they may no longer receive new Secure Boot and early-boot security protections that depend on updated trust certificates.
What is Secure Boot?
Secure Boot is a security feature built into modern UEFI firmware.
It checks digital signatures during the startup process so the device can block untrusted boot software.
Why certificates are involved
Secure Boot relies on a chain of trusted certificate authorities and databases.
Those certificates tell the firmware which boot components are trusted.
Why 2026 mattered
Microsoft had used certificates originally issued in 2011 across generations of Windows hardware.
Several began reaching expiration in 2026.
The first major date: 24 June 2026
The Microsoft Corporation KEK CA 2011 certificate was scheduled to expire on 24 June.
Another June date: 27 June 2026
The Microsoft UEFI CA 2011 certificate was scheduled to expire on 27 June.
October date
The Microsoft Windows Production PCA 2011 certificate had a later expiration date of 19 October 2026.
Why there was not one single deadline
Different certificates perform different jobs and expire on different dates.
That is why “eight weeks until Windows stops” would be inaccurate.
What Microsoft replaced them with
Microsoft created a set of 2023 Secure Boot certificates.
How home users receive them
For supported consumer devices, Microsoft has been rolling the new certificates out through Windows Update.
Do most users need to install them manually?
Microsoft says many consumer and Microsoft-managed devices receive the changes automatically.
Why some PCs need extra work
Older systems or business-managed machines may require firmware updates or administrator action.
What happens if the old certificate expires first?
The PC should still boot in ordinary cases.
Microsoft explicitly says standard Windows updates can continue.
What is lost?
The device may be unable to receive future protections involving Windows Boot Manager, Secure Boot databases, revocation lists and newly discovered early-boot vulnerabilities.
Why this is a security issue rather than an immediate functionality issue
The danger grows over time as new boot-level threats emerge.
Bootkits
Malware that compromises the startup environment can gain control before normal operating-system security tools are fully active.
Why revocation lists matter
If a previously trusted boot component is discovered to be vulnerable, Microsoft can add it to a revocation database.
An outdated trust configuration may be unable to receive future protection correctly.
BitLocker
Some security scenarios involving BitLocker hardening rely on Secure Boot trust.
Does certificate expiry decrypt BitLocker automatically?
No.
The issue is about future boot-chain protection, not an automatic mass decryption of drives.
How to check Windows Update
Open Settings, go to Windows Update and install the latest available updates.
Restart when required
Firmware and boot-security changes often require one or more restarts to complete.
Windows Security status
Microsoft added status information to the Windows Security app to help show whether Secure Boot certificate remediation has been applied.
Why users should not disable Secure Boot
Microsoft specifically warns against disabling it as a workaround.
Turning Secure Boot off removes an important startup protection.
Check manufacturer firmware
Some devices need an OEM firmware update to accept or deploy the newer certificates correctly.
Where to get firmware
Use the PC or motherboard manufacturer’s official support page, not a random download website.
Business PCs
Organisation-managed machines may not receive the same automatic rollout path as ordinary home PCs.
Why IT departments need more control
Large estates use different hardware generations, encryption policies and boot configurations.
Administrators may test certificate deployment before enabling it widely.
Servers
Secure Boot certificate renewal also affects supported Windows Server environments.
Virtual machines
Some Secure Boot-enabled Azure and virtualised Windows environments also require updated certificates.
Windows 10 is a separate issue
Windows 10’s general support status should not be confused with the Secure Boot certificate change.
Windows 10 support ended
Standard free support for Windows 10 ended on 14 October 2025.
Extended Security Updates
Eligible users and organisations can enrol in Microsoft’s ESU programme to keep receiving certain critical and important security updates during the transition.
Why ESU matters
A Windows 10 PC can physically continue working after support ends, but without regular security fixes the risk increases.
Does ESU automatically solve every Secure Boot issue?
No.
Users still need appropriate certificate and firmware updates.
Windows 11
Supported Windows 11 devices are also affected by the Secure Boot certificate transition because this is a firmware trust issue, not simply a Windows 10 issue.
Why newer PCs are easier
Recent devices are more likely to have firmware and update support designed around the new certificates.
Older unsupported devices
A manufacturer may stop publishing firmware for older hardware.
That can make long-term secure maintenance more difficult.
Should you replace a PC only because of this certificate?
Not automatically.
First check whether the machine has received the new certificates and whether the manufacturer still supports its firmware.
Why panic headlines were unhelpful
A phrase such as “upgrade now or Windows stops in eight weeks” would misrepresent Microsoft’s own guidance.
The accurate warning
Users needed to make sure their devices received newer Secure Boot trust certificates before or around the 2026 expirations to preserve full future boot-level protection.
What happened after June?
Microsoft continued delivering the newer certificates through Windows Update after the first expiration dates.
September 2026 Windows updates
Microsoft’s current Windows support pages still reference the Secure Boot transition and continue issuing security updates for supported systems.
Why updating late is still better than ignoring it
If a device missed the first June dates but can still receive the newer certificates, installing them helps restore the intended trust chain for future protection.
A practical checklist
Install current Windows updates, restart, check Windows Security, confirm Secure Boot is enabled and check the PC maker for firmware updates.
For Windows 10 users
Also verify whether the device is enrolled in ESU or whether an upgrade to Windows 11 is available.
For business users
Follow Microsoft’s administrator deployment guidance rather than making ad-hoc firmware changes across a fleet.
Back up before firmware work
Important data should be backed up before major firmware changes.
Keep the BitLocker recovery key available
Firmware and boot configuration changes can sometimes trigger a recovery-key prompt.
Do not download unofficial certificate packages
Boot-security updates should come from Microsoft, the hardware manufacturer or an approved enterprise-management process.
Conclusion
The April “eight weeks” warning referred to the first wave of Microsoft Secure Boot certificate expirations in June 2026.
The deadline has passed, but Windows PCs did not collectively stop working.
The security issue is subtler: devices that have not received the replacement 2023 certificates may lose the ability to receive future boot-level protections.
Keep Windows and firmware updated, leave Secure Boot enabled and use Microsoft’s current status guidance rather than relying on an old countdown headline.
Sources and further reading
See Microsoft’s Secure Boot expiration guidance and its certificate update table.
How the Secure Boot trust chain works
UEFI firmware stores trusted keys and certificate databases. A Key Enrollment Key can authorise changes to the databases, while allowed and revoked signature databases determine which boot components can run.
Why replacing certificates is delicate
A mistake in the trust chain could prevent legitimate boot software from being recognised. Microsoft therefore used a staged rollout rather than forcing every device to switch simultaneously.
What the KEK certificate does
The Microsoft Corporation KEK certificate helps authorise updates to Secure Boot databases. Its June 2026 expiration was one of the earliest major dates in the transition.
What the UEFI CA does
The Microsoft UEFI CA is used for third-party bootloaders and option ROMs. Microsoft split some of this trust into more specific 2023 certificates, allowing finer control over what a device accepts.
What the Windows Production PCA does
This certificate is associated with signing Windows boot-loader components. Its later October 2026 expiry means the overall transition extends beyond the first June dates.
Why dual-boot users should pay attention
Linux and other operating systems may rely on Microsoft-signed boot components on Secure Boot PCs. Users with custom boot configurations should follow their operating-system and hardware vendor guidance rather than improvising certificate changes.
Why businesses staged deployments
Enterprise administrators need to avoid a certificate change unexpectedly breaking specialised hardware, encrypted systems or recovery environments. Testing representative devices before broad deployment reduces that risk.
Event logs and management tools
Microsoft provides technical guidance for administrators to inventory affected systems and verify deployment status across managed fleets.
Why home users should not copy enterprise scripts blindly
PowerShell or registry instructions designed for managed environments can cause problems if used without understanding. Most ordinary users should rely on Windows Update and manufacturer firmware tools.
Secure Boot versus TPM
Secure Boot and the Trusted Platform Module are related security technologies but are not the same thing. TPM protects cryptographic keys and measurements, while Secure Boot controls trust in early startup software.
Secure Boot versus Windows 11 eligibility
Windows 11 hardware requirements brought Secure Boot into public discussion, but the 2026 certificate renewal is a separate maintenance issue affecting devices already running supported Windows versions.
Why older PCs can become harder to secure
Security depends on both operating-system updates and firmware support. If the PC maker has stopped issuing firmware, there may eventually be limits to how fully the machine can adopt newer boot protections.
Backups before firmware updates
Firmware updates are usually routine but operate at a low level. Maintaining a current backup protects important files if an unrelated failure occurs during the process.
BitLocker recovery preparation
Users with device encryption should know where the recovery key is stored. Changes in firmware or boot measurements can sometimes trigger a recovery prompt even when nothing malicious has happened.
Why Microsoft continued updates after June
The first expirations were not a switch-off date. Microsoft kept delivering certificate updates because many devices would reach the new trust state gradually.
The security lesson
Infrastructure certificates often have lifetimes measured in years, so replacement projects can sound obscure until an expiration date becomes close. The 2026 transition shows why operating-system security includes firmware and cryptographic maintenance, not just monthly antivirus fixes.