Secure Boot: Microsoft Windows Production PCA 2011 expires: 19 Oct 2026

19 Oct 202621 days agoMicrosoftEnd of support

Secure Boot: Microsoft Windows Production PCA 2011 expires

WindowsWindows Server

Who is affected: Windows devices whose boot manager still relies on the 2011 Windows Production PCA. The replacement is Windows UEFI CA 2023, which signs the Windows boot loader.
What to do: Confirm devices report the Windows UEFI CA 2023 certificate in the Secure Boot database.
Expect one extra restart on some devices when the Secure Boot certificate update applies.
Refresh boot media, PXE images and VM templates so they boot with the new certificate chain.
Source: Secure Boot certificates expiring in 2026“Microsoft Windows Production PCA 2011 | October 19, 2026 | Windows UEFI CA 2023 | Stored in DB | Used for signing the Windows boot loader.”
Manage Secure Boot certificate updates (Microsoft Learn)

Each date is quoted from the vendor’s own page. Dates move; check the source before you act.