Secure Boot 2011 certificates start expiring (KEK CA 2011 and UEFI CA 2011)

WindowsWindows Server

Who is affected

Windows PCs, servers and virtual machines with Secure Boot that do not yet have the 2023 certificates. They keep booting, but cannot apply future Secure Boot updates signed with the new authorities.

What to do

1. Check certificate status per device, for example with the Secure Boot status report in Windows Autopatch.
2. Keep devices on current monthly updates, which deliver the new certificates in phases.
3. Ask OEMs and hypervisor vendors for firmware or template updates where the update cannot apply.

Source

Secure Boot certificates expiring in 2026“Microsoft Corporation KEK CA 2011 | June 24, 2026 | Microsoft Corporation KEK 2K CA 2023 | Stored in KEK | Signs updates to DB and DBX.”

Secure Boot certificates expiring in 2026“Microsoft UEFI CA 2011 * | June 27, 2026 | Microsoft UEFI CA 2023 | Stored in DB | Signs third-party boot loaders and EFI applications.”

Tune in May 18 to ask Microsoft anything about Secure Boot“Secure Boot certificates start expiring in June of 2026.”

Checked 9 Nov 2026 Link to this deadline