Windows Secure Boot Certificate Update 2026: How to Check Your PC's Status

If you see a yellow caution badge or a status alert under Secure Boot in the Windows Security app, your computer is part of a planned transition to newer security certificates. Microsoft indicates that affected computers generally continue starting and receiving updates, rather than suddenly refusing to turn on or locking users out of Windows.

Microsoft is replacing the original Secure Boot digital certificates issued in 2011 with updated 2023 certificates because the older certificates begin expiring in 2026. For the majority of consumer laptops and desktop PCs, Windows Update delivers and installs these updates automatically in the background. Understanding what your specific status badge means, what to check, and when manufacturer action is required keeps your computer protected without unnecessary confusion.

What is the Secure Boot certificate update?

Secure Boot is a fundamental security standard built into modern computer motherboard firmware (UEFI). When you turn on your PC, Secure Boot inspects the digital signature of every piece of startup software, including hardware drivers (Option ROMs), the Windows Boot Manager, and operating system loaders, before allowing them to run. If a signature is untrusted or missing, the firmware blocks that component from loading, stopping pre-boot malware and rootkits before the operating system starts.

To verify these signatures, the computer firmware stores a collection of trusted digital certificates provided by Microsoft and your computer manufacturer:

• Key Enrollment Key (KEK): Authorizes updates to the allowed and revoked signature databases.
• Allowed Signature Database (DB): Contains trusted certificates used to validate boot loaders, operating system kernels, and hardware drivers.
• Revoked Signature Database (DBX): Contains digital signatures and cryptographic hashes of vulnerable or compromised software that must never be allowed to run.

The original digital certificates that have secured Windows computers since Windows 8 were created in 2011 with a 15-year lifespan. Several of these certificates reach their expiration dates in 2026:

• Microsoft Corporation KEK CA 2011: Expires June 24, 2026. It is being replaced by Microsoft Corporation KEK 2K CA 2023 in the KEK.
• Microsoft UEFI CA 2011: Expires June 27, 2026. It is being split into Microsoft UEFI CA 2023 (for third-party bootloaders and applications) and Microsoft Option ROM UEFI CA 2023 (for hardware option ROMs) in the DB.
• Microsoft Windows Production PCA 2011: Expires October 19, 2026. It is being replaced by Windows UEFI CA 2023 in the DB to sign the Windows Boot Manager.

Updating these trust anchors in your motherboard firmware ensures that future Windows boot components and security patches continue to be validated properly.

Does certificate expiration mean my PC will stop working?

Certificate expiration does not automatically brick a computer. According to official Microsoft Secure Boot expiration guidance (opens in new tab), devices that have not yet received the newer 2023 certificates generally continue starting into Windows and receiving standard operating system updates. Everyday applications, web browsing, games, and general operating system tasks continue to function.

However, remaining on outdated certificates creates genuine future security and compatibility risks:

1. Newer Windows Boot Manager releases: The device cannot validate or execute future Windows Boot Manager binaries signed exclusively with 2023 certificates.
2. Boot-level vulnerability fixes: Windows cannot apply new mitigations for newly identified pre-boot threats or firmware vulnerabilities.
3. Revocation updates: The system cannot safely apply updated DBX revocation lists designed to block untrusted or vulnerable bootloaders without risking startup failures.

At the same time, Microsoft's Secure Boot troubleshooting documentation (opens in new tab) acknowledges that certificate servicing can encounter device-specific update failures, BitLocker recovery prompts, or startup problems on certain hardware configurations. While expiration itself does not abruptly stop your PC from powering on, keeping the system current avoids these long-term security and servicing conflicts.

How to check Secure Boot certificate status

Windows 11 displays detailed Secure Boot certificate status directly inside the native Windows Security application.

To check your computer:

1. Click the Start button, type Windows Security, and press Enter.
2. In the left-hand navigation pane, select Device security.
3. Under the Secure Boot heading, look at the visual icon badge and read the descriptive text beneath it.
4. If a link or expandable section appears, click it to review the complete message.
5. Take note of the exact wording displayed on screen before deciding whether any action is needed.

[!NOTE] The visual badge color (green, yellow, or red) serves only as an overview summary, not a complete diagnosis on its own. For example, earlier versions of the Windows Security app displayed a green badge simply to indicate that the Secure Boot feature was enabled in firmware, regardless of certificate age. You must read the accompanying status text beneath the badge to confirm the exact state of your system.

If you open Device security and do not see a Secure Boot section, your Windows installation may not have received the relevant servicing update yet, or Secure Boot may not be supported by your hardware configuration. On systems running Windows 10, the interface rollout occurs through monthly cumulative updates, with advanced status badges gradually expanding to eligible devices. Keep in mind that Windows 10 Home and Pro reached official end of support on October 14, 2025. Ongoing security updates for Windows 10 require active enrollment in the Extended Security Updates (ESU) (opens in new tab) program or a supported long-term servicing edition. Secure Boot certificate servicing does not extend Windows operating system support.

What each status message means

Microsoft's Secure Boot certificate status guide (opens in new tab) documents several distinct status states. Use the descriptions below to interpret what your computer is reporting.

Fully updated

The status message states: "Secure Boot is on and all required certificate updates have been applied."

• Visual badge: Green checkmark.
• What it means: Your computer's motherboard firmware has successfully added the 2023 certificates to its KEK and DB databases, and the updated Windows Boot Manager is running.
• Action required: None. Your computer is completely up to date and protected.

Not yet updated (Pending automatic servicing)

The status message states: "Secure Boot is on, but your device is using an older boot trust configuration that should be updated."

• Visual badge: Informational banner or yellow caution icon.
• What it means: Your device is currently running on the 2011 certificates. Windows Update is managing the deployment and will deliver the update automatically in a staged rollout.
• Action required: Keep your computer connected to the internet and install all regular Windows updates. When Windows prompts you to restart after an update, complete the reboot so the firmware servicing task can execute.

Update paused because of a known issue

The status message states: "Secure Boot is on, but your device is affected by a known issue. To reduce risk, Secure Boot certificate updates are temporarily paused while Microsoft and partners work toward a supported resolution. The update will resume automatically once resolved."

• Visual badge: Yellow caution icon.
• What it means: Microsoft detected an issue or compatibility conflict on your specific hardware combination. To prevent startup errors, automated certificate servicing has been safely paused.
• Action required: Do nothing. Do not attempt manual workarounds or registry changes. The update will resume automatically through Windows Update once Microsoft and your device manufacturer release a verified fix.

Not enough data to classify

The status message states: "Secure Boot is on, but your device is using an older boot trust configuration that should be updated. There is not yet enough data to classify your device for automatic update."

• Visual badge: Informational banner or yellow caution icon.
• What it means: Microsoft's telemetry database does not yet have sufficient compatibility data for your hardware model to ensure a reliable automated update.
• Action required: Continue installing standard Windows updates and consult Microsoft's consumer servicing guidance at aka.ms/getsecureboot (opens in new tab). Microsoft continues to evaluate device telemetry over time, but this message does not guarantee that an automated update will definitely be offered for your specific hardware.

Update blocked by hardware or firmware limitations

The status message states: "Secure Boot is on, but your device does not support the automated Secure Boot certificate update due to hardware or firmware limitations. Contact your device manufacturer for assistance."

• Visual badge: Yellow caution icon.
• What it means: The motherboard firmware requires an update from the computer manufacturer (OEM) before it can store the new certificates in its non-volatile memory (NVRAM). In some instances, older PC models that have reached end-of-support status from the manufacturer may not receive new firmware.
• Action required: Visit your computer manufacturer's official support website, search for your exact model number, and check for available BIOS or UEFI firmware updates.

Requires action (Vulnerability detected)

The status message states: "Secure Boot is on, but this device can no longer receive required updates for the Windows boot experience."

• Visual badge: Red stop icon.
• What it means: A critical security vulnerability affecting the Windows boot experience exists, and it cannot be addressed on your computer until the updated certificates are in place.
• Action required: Check for urgent manufacturer firmware updates and ensure Windows has all latest cumulative security patches installed.

Secure Boot is turned off

The status message states: "Secure boot is off, your device may be vulnerable."

• Visual badge: Yellow caution or red warning icon.
• What it means: Secure Boot is disabled in your motherboard firmware setup. This status is distinct from certificate expiration; it simply means pre-boot signature verification is inactive.
• Action required: Consult your computer or motherboard manufacturer's documentation before attempting to change this setting. Do not turn on Secure Boot without preparation if your system uses disk encryption (such as BitLocker) or runs a dual-boot setup with Linux, as changing firmware boot modes can cause boot failures or unexpected recovery prompts.

What to do if the update is pending

If Windows Security indicates that your device has not yet updated, follow this calm, sequential procedure:

1. Open Settings > Windows Update and select Check for updates.
2. Allow Windows to download and install all pending quality updates, cumulative patches, and hardware driver updates.
3. Restart your PC when prompted. The Secure Boot servicing process uses a background scheduled task that applies updates across reboots to verify boot continuity at each stage.
4. Use the PC normally for several days. Microsoft stages certificate updates in phases across the worldwide device fleet to ensure stability.
5. Check your computer manufacturer's support application (such as Dell Command Update, Lenovo Vantage, HP Support Assistant, or ASUS Armoury Crate) to install any recommended BIOS or chipset updates.

Do not expect the status badge to flip immediately after a single reboot. Coordinated firmware updates require multiple verification checks before Windows confirms the transition.

What if the certificate update is blocked?

When Windows Security indicates that an update is blocked by hardware or firmware limitations, Microsoft's guidance for prevented devices (opens in new tab) recommends consulting your PC manufacturer.

Motherboard manufacturers program the non-volatile storage that holds Secure Boot keys. Some older motherboards have limited space in their NVRAM chips, or require updated firmware logic to handle multiple certificates simultaneously.

To address a blocked status safely:

• Find your exact PC model: Press Windows + R, type msinfo32, press Enter, and look at System Model and BIOS Version/Date.
• Visit the official manufacturer support portal: Go directly to the support page for Dell, HP, Lenovo, ASUS, Acer, MSI, or your motherboard brand. Avoid third-party driver-download utilities.
• Review recent BIOS release notes: Look for mentions of "Secure Boot CA update", "2023 certificate support", or "UEFI security enhancements".
• Install the BIOS update following official instructions: Keep your laptop plugged into wall power, and never turn off the computer while firmware is writing.

If your computer is older and the manufacturer has ceased firmware updates for that model, the machine will continue to function. You do not need to discard a working PC solely because it cannot update Secure Boot certificates. However, keep operating system support lifecycles in mind: Windows 10 Home and Pro reached end of support on October 14, 2025. Older PCs running those editions only receive monthly security updates if enrolled in Microsoft's Extended Security Updates (ESU) (opens in new tab) program or running a long-term servicing channel edition. Secure Boot servicing does not extend an operating system's lifecycle. Supported Windows 11 PCs continue to receive regular OS patches, but will lack updated pre-boot protections.

What not to do: common mistakes to avoid

Misinformation circulating on internet forums has led some users to take counterproductive actions. Avoid these common mistakes:

• Do not turn off Secure Boot to make the warning badge disappear. Disabling Secure Boot removes all boot-time validation, making your device substantially less secure than leaving it on with an older certificate.
• Do not run unverified PowerShell or Command Prompt scripts found on Reddit or community forums that claim to force-write certificates to your firmware. Overwriting firmware keys with incorrect variables can render a computer unbootable.
• Do not make generic, unguided changes in your BIOS setup. Only adjust settings specified by your computer manufacturer's official documentation.
• Do not edit the Windows Registry to bypass security checks unless following an official enterprise deployment guide provided by Microsoft for managed environments.

Our Windows 11 battery drain and firmware troubleshooting guide explains how firmware configurations and power rails interact directly with operating system stability. Treating firmware with care prevents accidental startup failures.

Does this affect BitLocker, regular Windows updates, or startup?

Microsoft's technical documentation clarifies the real-world impact of the certificate update on key Windows components:

Regular Windows updates

Normal Windows updates delivered on Patch Tuesday do not stop working. Windows Update continues to service the operating system, Windows Defender antivirus definitions, and user applications regardless of your Secure Boot certificate status.

BitLocker and device encryption

Microsoft's troubleshooting documentation notes that Secure Boot certificate updates can trigger BitLocker recovery prompts in certain device configurations. Updating certificates in NVRAM or replacing the Windows Boot Manager alters platform boot measurements verified by your Trusted Platform Module (TPM). If a measured PCR value does not match the expected seal, BitLocker halts startup and asks for your 48-digit recovery key. Firmware updates supplied by your PC manufacturer can trigger the same prompt.

Before applying motherboard firmware updates or completing restarts after major boot-servicing updates, make sure your BitLocker recovery key is backed up and accessible from another device or printed out. You can retrieve your saved key through your Microsoft account at account.microsoft.com/devices/recoverykey. Do not universally suspend disk encryption for routine servicing; having your recovery key on hand provides protection without leaving unencrypted drives exposed.

Dual-boot and Linux distributions

If your computer dual-boots Windows alongside Linux distributions (such as Ubuntu, Fedora, or openSUSE), the renewal of the Microsoft UEFI CA 2011 certificate directly affects third-party bootloaders (such as GRUB). Major Linux distributions have issued updated shims signed with the new 2023 certificates. Ensure your Linux installation is fully updated through its package manager so its bootloader matches your updated firmware keys.

Troubleshooting decision table

Use this quick-reference table to identify your observed Secure Boot status and determine the next safe action.

Frequently asked questions

Will my PC stop booting when a Secure Boot certificate expires?

Certificate expiration does not automatically brick a computer. Microsoft states that affected systems generally continue starting and receiving standard Windows updates. However, running older certificates creates future security and compatibility risks because the device cannot receive newer boot manager updates or vulnerability mitigations. Additionally, Microsoft notes that in certain configurations, certificate update attempts can encounter device-specific failures, BitLocker recovery prompts, or startup issues. If your PC halts at startup with a signature error, see our guide on resolving a Secure Boot Violation.

How do I check whether my Secure Boot certificates are updated?

Open the Windows Security app, select Device security, and look under Secure Boot. Read the text description beneath the icon. Your device is fully updated only if the text states that all required certificate updates have been applied.

Why is Windows Security showing a yellow Secure Boot warning?

A yellow caution icon indicates an actionable state, such as an update that is pending, an update paused due to a known compatibility issue, or a hardware limitation that requires a firmware update from your PC manufacturer.

What does "Secure Boot certificate update requires action" mean?

This message indicates that a security update for the Windows boot sequence is available, but your computer cannot receive it until its Secure Boot certificates are renewed. You should install all pending Windows updates and check your computer manufacturer's website for an available BIOS update.

Should I turn off Secure Boot to remove the warning?

No. Disabling Secure Boot removes your computer's defenses against pre-boot malware and bootkits. Leaving Secure Boot turned on with older certificates is significantly safer than disabling Secure Boot entirely.

What if my PC says its Secure Boot update is blocked?

If the update is blocked by hardware or firmware limitations, visit your PC manufacturer's official support website and check whether an updated BIOS/UEFI version is available for your model. If your computer is older and no longer receives manufacturer firmware updates, it can continue handling everyday computing tasks. Keep in mind that Windows 10 Home and Pro reached end of support on October 14, 2025; ongoing monthly security updates require an active Extended Security Updates (ESU) (opens in new tab) subscription or an edition with extended support. Secure Boot servicing does not extend an operating system's lifecycle.

Sources and further reading

• Microsoft Support: Secure Boot certificate update status in the Windows Security app (opens in new tab)
• Microsoft Support: Windows Secure Boot certificate expiration and CA updates (opens in new tab)
• Microsoft Support: Guidance for devices prevented from updating Secure Boot certificates (opens in new tab)
• Microsoft Support: Secure Boot troubleshooting guide (opens in new tab)
• Microsoft Learn: Extended Security Updates (ESU) program for Windows 10 (opens in new tab)
• Microsoft Support: Secure Boot consumer guidance (aka.ms/getsecureboot) (opens in new tab)
• Microsoft Learn: Overview of Windows Secure Boot (opens in new tab)