How to check if your PC is affected by expiring Secure Boot certificates

A set of Microsoft Secure Boot certificates issued in 2011 are expiring this week. The first certificate expires today, June 24, 2026, with additional Microsoft UEFI certificates expiring in late June and the Windows Production PCA expiring October 19, 2026. Secure Boot, enabled by default on new PCs sold with Windows 10 and Windows 11, acts as a gatekeeper that allows only trusted software to run at startup.

When those certificates expire they can no longer validate boot software. Your computer will still start, but it will stop receiving updates to Windows Boot Manager, Secure Boot databases and revocation lists, and fixes for newly discovered vulnerabilities in the boot chain.

Disabling Secure Boot can restore booting but may prevent access to BitLocker-encrypted disks without the recovery key. Microsoft issued replacement certificates in 2023, and hardware partners have been provisioning updates since 2024.

secure boot, microsoft, uefi certificates, windows 10, windows 11, boot manager, bitlocker, certificate expiration, revocation lists, replacement certificates