Most PCs will boot fine today. That doesn't mean you're in the clear. Microsoft's last major Secure Boot certificate from 2011 expires October 19, 2026, and devices that haven't picked up the newer 2023 certificates can fall behind on future security patches.
Two certificates already expired in June. Today's the last major one: the Windows Production PCA 2011. If your firmware is current, this is a non-event. If it isn't, you'll want to act before the next patch cycle.
What Secure Boot does
Secure Boot is the security guard that runs before Windows loads. It checks the digital signature on every piece of boot software — bootloader, drivers, firmware-level tools — and refuses to load anything that doesn't pass. It's been a cornerstone of Windows security since Windows 8.
The whole system relies on a chain of trusted certificates baked into your PC's firmware. Microsoft has been gradually retiring older certificates and replacing them with a 2023 generation. Hardware vendors must push updated firmware so those new certificates are recognized. Older machines, or models the vendor has stopped supporting, may never get the new keys — and that's where today's expiration matters.
Who should care
| Situation | Action needed? |
|---|---|
| Modern mainstream laptop (Dell, HP, Lenovo, ASUS) from 2020 onward | Low risk — Windows Update handles most cases automatically |
| Older business laptop or desktop from 2018–2022 | Medium risk — check status; may need manual firmware update |
| Custom desktop with discontinued motherboard | Higher risk — check status; firmware updates may not exist |
| Anyone who disabled automatic updates | Higher risk — update status immediately |
How to check your status
Open Settings. Go to Privacy & Security > Windows Security > Device security. Click Secure Boot. You'll see a status message.
- Green tick:** current. Nothing to do.
- "Older boot trust configuration" or yellow warning:** pending updates. Run Windows Update, install everything, restart.
- Red stop sign or warning that updates can no longer be received:** expired certificates. You need a manual BIOS update.
The red warning is rare on hardware from the last five years, more common on older or off-brand machines.
Updating firmware if needed
Worst case, you need a manual firmware update. The process is straightforward, just slow.
- Back up your BitLocker recovery key before changing firmware. Some BIOS updates can trigger a recovery loop.
- Find your exact model number in Settings > System > About. Search for it on your manufacturer's support site.
- Download the BIOS update for your exact model. Don't apply a different model's firmware.
- Keep the laptop plugged in throughout. Don't interrupt the update — a failed flash can brick the device.
- Reboot and re-check the Secure Boot status page.
Our analysis
Certificate rotations look dull, and they are, until something breaks. The 2011-to-2023 transition has been gradual, with two earlier expirations in June 2026 smoothing the path. That staggered rollout gives vendors time to push firmware and users time to notice.
The real question is who falls through the cracks. Older business laptops, retired enterprise machines still in home use, custom-built desktops with discontinued motherboards. These are the devices most likely to land on the "requires action" red warning.
The risk isn't catastrophic. Your PC keeps booting. The slow-burn problem is missing future Secure Boot–related updates — exactly the kind of maintenance you'd rather not skip.
What to watch:** future expiration dates for remaining 2011-era certificates, and whether Microsoft extends the rollout for vendors that haven't finished pushing updates.
Bottom line
Check the Secure Boot status page today. Green means nothing to do. Yellow means install updates and reboot. Red means schedule a firmware update with your laptop plugged in. Don't put this off — it takes a few minutes and locks in your future security maintenance.
Key takeaways
- The Windows Production PCA 2011 certificate expires October 19, 2026, completing the third phase of Microsoft's 2026 rotation.
- Settings > Privacy & Security > Windows Security > Device security > Secure Boot is the only place you need to check.
- Always back up your BitLocker recovery key before flashing a BIOS update.
- Older or unsupported hardware may show the red warning with no fix available from the vendor.
Frequently asked questions
Will my PC stop booting after October 19, 2026?
No. Most PCs continue booting normally. The issue is forward-looking — expired certificates can prevent future Secure Boot updates from installing.
How do I check my Secure Boot certificate status?
Open Settings, go to Privacy & Security > Windows Security > Device security, and click Secure Boot. A green tick means you're current.
Do I need to flash my BIOS today?
Only if your Secure Boot status shows a red warning. Most users will see yellow, which Windows Update clears with a regular patch cycle.
Is this related to Windows 10 end of support?
No. This is a separate certificate expiration tied to Secure Boot firmware. It affects Windows 10 and Windows 11 machines alike.
What if my manufacturer doesn't have a BIOS update for my device?
If your vendor has dropped support and no firmware update is available, your device will stay on the red warning. You can continue using it, but you'll miss future Secure Boot updates. Replacing the motherboard or the entire PC are the only permanent solutions.