Schematische Darstellung der Secure-Boot-Kette mit Firmware, UEFI-Vertrauensdatenbank und Windows-Start

Secure Boot 2026: Check certificates and schedule updates securely

Short conclusion: The secure boot certificates from 2011 expire in 2026. According to Microsoft, this does not mean that a PC will automatically no longer start on the deadline: regular Windows updates can also continue to run. However, without the newer certificates, future early boot protection updates may be missing. Therefore, check the status, take UEFI firmware and BitLocker into account and roll out changes in a controlled manner.

Schematic four-step verification path for secure boot certificates: updates, status, firmware and pilot group
The test path is a diagram, not a representation of a Windows interface. It follows Microsoft's recommendations for status control, OEM firmware and piloting.

What will change in 2026

Secure Boot checks digital signatures in the UEFI firmware of components that are loaded before Windows. This includes startup programs and UEFI drivers. The trust entries are in firmware databases such as DB, DBX and KEK. The renewal affects this trust chain; it is not an ordinary Windows feature update.

Microsoft lists the 2011 certificates as expiring. The 2011 Microsoft Corporation KEK CA is dated June 24, 2026, the Microsoft UEFI CA is dated June 27, 2026, and the Microsoft Windows Production PCA is dated October 19, 2026. The new certificates are from 2023. Which of these a device needs depends on its use and the firmware; For third-party bootloaders and option ROMs, separate UEFI trust zones are relevant.

The classification is important: An expired certificate does not switch off Secure Boot across the board. Microsoft says affected devices can continue to boot and receive normal Windows updates. However, new protection measures for boot managers, blacklists or other early boot components may be missing in the future. This is a security and maintenance issue, no reason to change BIOS settings without checking the device.

What should I check first?

  1. Windows and OEM Notes: Install regular supported Windows updates and check the device or motherboard manufacturer's support page for the exact model and UEFI version.
  2. Status messages: Microsoft mentions event IDs 1801 and 1795 and the status value UEFICA2023Status as possible clues. They are diagnostic signals and should be evaluated in the context of Microsoft documentation.
  3. Secure boot configuration: Check whether Secure Boot is actually active on the device and whether there are special cases such as alternative boot systems, network boot or older expansion cards.
  4. BitLocker and recovery: Microsoft cites unexpected BitLocker recovery queries as a possible issue with incompatible or outdated firmware. Therefore, have the intended recovery path ready before making any firmware or certificate changes.
Impact and safe test instructions according to Microsoft documents (test date: October 19, 2026)
Area What Microsoft describes Safe next step
Normal Windows usage Affected devices can continue to boot; regular Windows updates can still be installed. No reason for a hectic reinstallation. Check certificate status separately.
Protection from Windows startup Without updated 2023 certificates, future protections for boot managers and other early boot components may be missing. Schedule new certificates via the supported Windows and OEM route.
UEFI firmware and BitLocker For older or incompatible firmware, Microsoft lists possible validation errors, recovery queries or boot problems. Follow OEM firmware instructions and test changes on a representative pilot group first.

Advantages and limitations of the update

  • Advantage: Updated UEFI trust data keeps early boot component protection as intended.
  • Advantage: A controlled procedure makes it visible which device models are already updated and which require OEM support.
  • Limit: The procedure depends on the device, firmware version and management. A general registry intervention is not a safe replacement for the manufacturer's instructions.
  • Limit: Firmware problems may occur with older or specially configured devices. Microsoft recommends checking firmware and piloting changes with different devices and BitLocker configurations first.

Recommendation for private users and IT teams

Private users: Keep Windows up to date, check the device manufacturer's support page for firmware information and do not blindly deactivate Secure Boot if errors are reported. If events indicate a problem or BitLocker Recovery appears, contact the device manufacturer or qualified technical support with the model and UEFI version.

IT Teams: Capture manufacturer, model, firmware and BitLocker status. Use Microsoft's supported management channels such as Intune, Group Policy, CSP or documented registry policies and set up a small pilot group with multiple OEMs and firmware levels. Then check the status and only then the broad distribution. Separate instructions sometimes apply to servers; the client planning described here should not be transferred without checking.

For background on Windows compatibility planning, see also our already published article Windows 10 after end of support: Check or change PC?.

Related sources

In-depth video: Microsoft's Ask Microsoft Anything: Secure Boot - February 2026 (channel Windows At Work). The video is a longer question and answer session for IT managers and is therefore only linked as an original source, not embedded. Title and channel were checked via YouTube oEmbed on October 19, 2026.

Checked on October 19, 2026. Author: TechDesk PE Digital.Networks. This orientation does not replace any device-related manufacturer instructions.

Back to blog

Leave a comment