The Microsoft Windows Production PCA 2011 certificate, which signs the Windows boot manager and sits in the Secure Boot allowed database (DB), expires on Monday, October 19, 2026 at 18:51 UTC (14:51 ET, 11:51 PT), according to the certificate's own validity field. Its replacement is the Windows UEFI CA 2023. PCs that lack it keep booting and installing regular updates, but stop receiving new boot manager fixes and other early-boot protections.

It is the last of three 2011 Secure Boot certificates to lapse in 2026. Below: how to check a single machine, how to roll the update out to a fleet, and the firmware, BitLocker and VM problems to expect. More in our Security section.

The three 2011 certificates and their replacements

Per Microsoft's certificate expiration article:

  • Microsoft Corporation KEK CA 2011 (KEK): expired June 24, 2026. Replaced by Microsoft Corporation KEK 2K CA 2023, which authorizes changes to DB and DBX.
  • Microsoft UEFI CA 2011 (DB): expired June 27, 2026. Replaced by Microsoft UEFI CA 2023 for third-party boot loaders and Microsoft Option ROM UEFI CA 2023 for option ROMs.
  • Microsoft Windows Production PCA 2011 (DB): expires October 19, 2026. Replaced by Windows UEFI CA 2023, which signs the Windows boot loader.

What actually happens on October 19

Nothing stops working at expiry. Microsoft says an unupdated device still starts and installs standard Windows updates. It loses boot-chain servicing: new Windows Boot Manager versions, Secure Boot database and revocation updates, and fixes for new boot-level flaws. Microsoft also advises against disabling Secure Boot as a workaround.

The date does not revoke anything either. Adding PCA 2011 to the DBX forbidden list is a separate BlackLotus (CVE-2023-24932) mitigation, and as of October 2026 KB5025885 still lists its enforcement phase as date to be announced, with at least six months' advance notice promised.

How to check a single machine

  1. Confirm Secure Boot is on: in elevated PowerShell, Confirm-SecureBootUEFI should return True.
  2. Look for the new CA in DB: [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023' returns True if present. On systems with the April 14, 2026 cumulative update or later, Get-SecureBootUEFI -Name db -Decoded lists every certificate with its validity dates. Microsoft's sample output there shows ValidTo as 11:51:42Z, but the certificate itself records 18:51:42 UTC, which is 11:51 Pacific time.
  3. Read the servicing state: Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" | Select-Object UEFICA2023Status, UEFICA2023Error. "Updated" means the certificates and the new boot manager are in place; a non-zero error needs investigating.
  4. Check the System log, source TPM-WMI (event reference): 1808 means fully updated, 1801 means not yet applied, 1803 means the OEM has not supplied a signed KEK.

From April 2026 the Windows Security app gradually began showing status under Device security > Secure Boot. "Temporarily paused" there means Microsoft is holding the device back over a known issue; the update resumes automatically.

Rolling it out across a fleet

Updates from November 11, 2025 onward provide three equivalent controls:

  • Registry: set AvailableUpdates under HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot to 0x5944. The task \Microsoft\Windows\PI\Secure-Boot-Update runs every 12 hours or on demand with Start-ScheduledTask (registry reference).
  • Group Policy: Computer Configuration > Administrative Templates > Windows Components > Secure Boot > Enable Secure Boot Certificate Deployment (GPO guide).
  • Intune: a Settings catalog profile with Enable Secureboot Certificate Updates (Intune guide).

Microsoft also pushes the certificates through monthly cumulative updates to device groups ("buckets") it rates "high confidence" (HighConfidenceOptOut = 1 opts out). Its FAQ calls this an assist, not a guarantee. The IT pro guidance suggests testing four or more devices for each manufacturer, model and firmware version combination, and estimates 48 hours and one or more restarts per device. The October 2026 Patch Tuesday falls on October 13; see our Patch Tuesday calendar.

Firmware, KEK and BitLocker risks

  • The KEK update needs a KEK signed by the OEM's Platform Key. Without it, Windows logs event 1803 and, per the troubleshooting guide, there is no supported workaround; older out-of-support models may stay stuck.
  • Some firmware overwrites DB instead of appending to it, leaving the device unbootable. Install current OEM firmware first.
  • Event 1032 means the update was held because it would trigger BitLocker recovery; Microsoft's fix is manage-bde -protectors -disable %systemdrive% -rebootcount 2, then two restarts. Escrow recovery keys first; a PXE-first boot order can trigger recovery on every boot.
  • Do not reset Secure Boot to factory defaults on an updated machine unless the firmware defaults include the 2023 certificates. If it happens, Microsoft's SecureBootRecovery.efi utility, booted from a USB drive, adds the Windows UEFI CA 2023 back to DB.

Virtual machines

On Hyper-V, a KEK update failure (event 1795) was fixed in the March 10, 2026 updates (April 14, 2026 for Windows Server 2025); patch both host and guest (known issues). The same page still lists an open issue where the KEK step can log event 1795 on some Azure Trusted Launch VMs; Microsoft says no customer action is required and a fix will come in future updates. Azure Trusted Launch and Confidential VMs created after March 2024 usually have the 2023 certificates and need only the boot manager; older ones need both, and golden images do not carry firmware variables (Azure guidance). On other hypervisors, the vendor can ship updated virtual firmware for new VMs, or Windows updates long-running VMs if the firmware allows it. See also our Cloud coverage.

Linux shim trust depends on the Microsoft UEFI CA 2011, which expired on June 27, not on this certificate.

Frequently asked questions

Will Windows stop booting on October 19, 2026?

No. Devices without the 2023 certificates keep starting normally; they stop receiving new boot-level security fixes.

Can I still update after the deadline?

Yes. The Secure Boot FAQ says cumulative updates can still apply the 2023 certificates after the old ones expire.

Do Windows 10 PCs get the new certificates?

Microsoft says only supported Windows versions receive them, so Windows 10 devices need ESU enrollment or an in-support LTSC edition.