The certificates that Secure Boot has trusted since 2011 start expiring this month. Most machines will update themselves. The ones that won’t are exactly the ones nobody is watching. Here is what Secure Boot is, what is changing and how to check your machine.
What Is Secure Boot
Secure Boot is a feature of your computer’s firmware (UEFI). Its job is simple: only let trusted software run while the machine starts up.
When you power on a PC, the firmware checks the digital signature of everything that runs before Windows does, including boot loaders and firmware drivers. Those signatures are verified against a set of certificates stored in the firmware itself. If the signature does not match a trusted certificate, the code does not run. This is what protects you from bootkits, which is malware that loads before the operating system and hides from antivirus tools.
Microsoft introduced Secure Boot with Windows 8. Nearly every Windows machine since then carries the same set of Microsoft certificates from 2011. Those certificates were issued with a 15 year lifespan and that clock is now running out.
What Is Expiring and When
| Expiring Certificate | Expires | Replacement |
|---|---|---|
| Microsoft Corporation KEK CA 2011 | June 24, 2026 | Microsoft Corporation KEK 2K CA 2023 |
| Microsoft UEFI CA 2011 | June 27, 2026 | Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023 |
| Microsoft Windows Production PCA 2011 | October 19, 2026 | Windows UEFI CA 2023 |
The first two expire this month. The KEK is the key that signs updates to the Secure Boot trust databases. The others sign the Windows boot loader, third-party boot loaders and option ROMs.
What Happens If Your Machine Does Not Get the New Certificates
Your machine will not stop working. It will boot normally and keep installing standard Windows updates. Microsoft has been clear on that.
What stops is security servicing for the boot process itself. No more updates to Windows Boot Manager. No more updates to the Secure Boot revocation lists. No mitigations for newly discovered boot level vulnerabilities. Over time that also affects anything that depends on Secure Boot trust, including BitLocker hardening and third-party boot loaders.
In plain terms: the lock on your front door keeps working, but the locksmith stops making new keys when someone figures out how to pick it.
Who Should Pay Attention
Most machines get the new 2023 certificates automatically through Windows Update. The ones that miss out fall into a few groups:
- Machines that are not connected to the internet. No connection, no certificate update. Air-gapped boxes, lab machines and offline workshop PCs need manual attention.
- Machines with outdated firmware. Testing by Windows Latest found the certificate update quietly failing on thousands of PCs because the firmware cannot accept it. The fix is a firmware update from the manufacturer, if one exists.
- Windows 10 machines without ESU. Windows 10 support ended in October 2025. If you are still on Windows 10 and not enrolled in Extended Security Updates, you are not getting these certificates or much else. If that is you, fix that first. The certificate updates are being shipped to ESU machines through the normal monthly updates.
- Older hardware in general. Some devices have hardware or firmware limits that block the update entirely. Microsoft’s answer for those is to contact the manufacturer.
How to Check Your Machine
Windows now shows the certificate status right in the Windows Security app:
- Open Windows Security
- Go to Device security
- Look at the Secure Boot entry
You will see one of three states:
- Green checkmark: the new certificates are applied. Nothing to do.
- Yellow badge: something needs your attention, usually a firmware limitation. Check for firmware updates from your manufacturer.
- Red badge: your device’s boot configuration cannot be serviced. Visit aka.ms/getsecureboot for next steps.
Microsoft can also pause the rollout on specific configurations while compatibility issues are investigated. If your machine shows the update as paused, it resumes on its own once the issue is resolved.
About That New SecureBoot Folder
If a folder named SecureBoot showed up in C:\Windows after a recent update, leave it alone. It arrived with KB5089549 and people understandably assumed the worst.
Microsoft confirmed it is expected behavior, not malware and not a bug. It holds seven PowerShell scripts built for IT administrators. One checks whether the 2023 certificates are installed. Another makes sure the scheduled task that applies the certificates is enabled. None of them run on their own or change anything by themselves. Do not delete the folder. A future update may need it or will remove it when it is no longer required.
Sources
- Microsoft: Windows Secure Boot certificate expiration and CA updates
- Microsoft: Secure Boot certificate update status in the Windows Security app
- Microsoft Q&A: How to verify the Windows Secure Boot certificates
- Windows Latest: Windows 11 gets Secure Boot KEK update on more PCs, requires a reboot
- Windows Latest: Microsoft confirms the new Secure Boot folder in Windows 11 isn’t a bug
- Windows Report: Windows 11 KB5089549 creates new SecureBoot folder, Microsoft says it’s normal
- Eleven Forum: Update Secure Boot Allowed Key Exchange Key (KEK) causing problems
Your Turn
Check your machines, especially the ones that sit offline or have not seen a firmware update in years. What does your Secure Boot status show? If you hit a yellow or red badge, post your hardware details below and we will work through it.