Is your PC ready for the Windows 11 Secure Boot certificate change that lands on October 19, 2026? For most people the answer is already yes, and Windows will have handled it quietly in the background. But a small number of machines slip through, and Windows now gives you a built-in way to check your own PC in about two minutes. This is not urgent for the vast majority of readers, but the check is quick, so it is worth doing today.

Here is the plain-English version of what is going on. Microsoft has been rolling out replacement security certificates through 2026, updating the trust chain that Secure Boot relies on during startup. This applies to both Windows 10 and Windows 11. The old certificates date back to 2011 and are reaching end of life; new 2023-era certificates are taking their place.

Windows 11 laptop on a desk, representing the Secure Boot certificate update PC owners should check for
Image: Microsoft

Why the Secure Boot certificate update is happening

Secure Boot is a firmware-level feature that only lets trusted, digitally signed software run while your PC starts up. It does this by checking startup code against a set of built-in certificates. Those certificates were issued in 2011, and 15 years later they are expiring on a staggered schedule:

  • Microsoft Corporation KEK CA 2011 — expired June 24, 2026
  • Microsoft UEFI CA 2011 — expired June 27, 2026
  • Microsoft Windows Production PCA 2011 — expires October 19, 2026

The first two have already lapsed. The third one, expiring on October 19, 2026, is the deadline that matters most going forward. To replace them, Microsoft is issuing new certificates dated 2023 — including a new KEK, updated UEFI CAs, and an Option ROM certificate for peripheral firmware. You do not need to memorise those names. The takeaway is simply that fresh certificates are replacing ones that are old enough to have shipped with Windows 7.

What happens if your PC is not updated in time

This is where a lot of the coverage gets it wrong, so let us be precise. If your PC does not receive the new certificates by the deadline, it keeps starting and running completely normally. Windows Update keeps working. There is no sudden failure, no boot error, and nothing “bricks.”

What actually changes is narrower: the PC stops being eligible for new security updates to the early boot process specifically — things like the Windows Boot Manager, the Secure Boot certificate and revocation databases, and fixes for newly discovered boot-chain vulnerabilities. Everything else updates as usual. Over months and years that becomes a quietly growing gap in one specific layer of security, not an immediate problem. That is a reason to check, not a reason to panic.

How to check your Windows 11 Secure Boot certificate status

Windows has a status indicator built right into the security app. Here is exactly where to look:

  1. Open the Start menu, type Windows Security, and open the app.
  2. Select Device security.
  3. Find and open the Secure Boot section.
  4. Read the status badge and its message.

The colour of the badge tells you everything you need to know:

  • Green checkmark — “Secure Boot is on and all required certificate updates have been applied.” You are done. No further action is needed.
  • Yellow caution — “Secure Boot is on, but your device is using an older boot trust configuration that should be updated.” Install the latest Windows updates and restart. If it still shows yellow afterwards, a firmware/BIOS update from your PC maker may be needed.
  • Red / stop icon — one of two messages. Either your device cannot take the automated update because of hardware or firmware limitations (you will need a BIOS/firmware update from the manufacturer), or, in the most serious case, “this device can no longer receive required updates,” where Microsoft points you to aka.ms/getsecureboot for guidance.
  • No Secure Boot section at all — Secure Boot is likely turned off in firmware, or the PC is running in Legacy BIOS/CSM mode, or the hardware never required it. That is a separate situation from certificate expiration, covered below.

What to actually do about it

For almost everyone, the fix is the same simple habit that keeps a PC healthy anyway:

  1. Go to Settings > Windows Update and choose Check for updates. Install everything offered, then restart. Microsoft delivers the new certificates automatically through Windows Update to consumer PCs and most business devices, so this alone covers the large majority of machines.
  2. If Windows Security still shows yellow or red, visit your PC or laptop maker’s support site and look for a BIOS/firmware update for your exact model. Dell, HP, Lenovo, Asus and Acer have all published updated firmware for affected models.

Two important cautions. First, never disable Secure Boot to make a yellow or red warning go away — that removes a genuine protection instead of fixing anything. Second, if you are about to install a BIOS/firmware update and you have BitLocker device encryption switched on, back up your BitLocker recovery key first, either from Settings > Privacy & security > Device encryption or through your Microsoft account at aka.ms/myrecoverykey. This is standard hygiene before any firmware update — not something this certificate change causes. Microsoft has said BitLocker recovery is not expected behaviour from this update, so treat the key backup purely as routine caution. (We covered a related BitLocker fix in the Windows 11 July 2026 security update that fixes a record 570 flaws.)

Finally, very old PCs — roughly pre-2013 machines that shipped with Windows 7 or 8 and run in Legacy BIOS/CSM mode — never had these certificates in the first place. They are not affected, there is nothing to update, and this is not a reason to rush out and replace a working machine.

The honest caveat

For the overwhelming majority of readers this is a non-event that Windows Update quietly resolves. The one genuine limitation worth naming: if your PC shows a red status because of hardware or firmware constraints, the fix depends on your manufacturer shipping an updated BIOS — and for older or discontinued models, that update may never arrive. There is no consumer-side workaround for that beyond eventually moving to newer hardware, and even then, an unpatched machine keeps working; it simply misses future boot-layer security fixes. Check your status today, install your updates, and you will know exactly where you stand well before October 19.

Sources: Microsoft Support, Microsoft Support, Microsoft Windows Experience Blog