Hi everyone, Alex here again.
Today we’re going to talk about a piece of Windows infrastructure that most people never think about — until it suddenly matters. I’m talking about Secure Boot and the upcoming expiration of the Microsoft 2011 certificate in October 2026.
Nothing is going to explode overnight, but if you manage Windows devices at scale, this is definitely something you should start paying attention to.
For the first time since Secure Boot was introduced with Windows 8, the original Microsoft Secure Boot signing infrastructure is approaching a major milestone. The Secure Boot certificate chain introduced in 2011 is set to expire in October 2026, and Microsoft has announced that it will stop signing boot components with the 2011 Certificate Authority (CA).
At first glance this might sound like a routine certificate rotation. In reality, it affects one of the most fundamental security layers in modern Windows systems. Organizations running Windows devices need to start preparing now to avoid limitations in future boot security updates.
Why this matters
Secure Boot is part of the UEFI firmware security architecture. Its purpose is simple but critical: ensure that only trusted, signed boot components are executed when a device starts.
When a Windows device boots, firmware validates several elements in a chain of trust:
-
Firmware verifies the bootloader signature.
-
The bootloader verifies the Windows Boot Manager.
-
The Boot Manager verifies the kernel and other early system components.
All of these components are validated against trusted certificate authorities stored in the firmware database (db).
The problem is that the original Microsoft Secure Boot CA used for signing these components dates back to 2011. After October 2026, Microsoft will stop signing boot components using that certificate.
Instead, the ecosystem will move to a new certificate hierarchy introduced in 2023.
What happens if nothing is done?
Interestingly, systems will not suddenly stop booting when the certificate expires.
Devices that still rely on the 2011 CA will continue to function in most everyday scenarios:
-
Systems will still boot normally.
-
Windows Update will continue delivering monthly patches.
-
Existing boot components will still be trusted.
However, there are important limitations that administrators should be aware of.
Without the newer certificate infrastructure in place:
-
New Boot Manager versions cannot be deployed
-
Future Secure Boot security improvements cannot be applied
-
Some third-party boot components and drivers may fail installation
-
Certain boot-level protections introduced in future Windows releases will not activate
In other words, the system will keep running, but the boot security layer will effectively stop evolving.
Over time this could leave devices unable to adopt new boot-time security protections.
Microsoft’s transition to the 2023 Secure Boot CAs
To address this, Microsoft introduced a new Secure Boot certificate chain in 2023.
This new CA hierarchy allows Microsoft and hardware partners to continue signing boot components beyond 2026 while also improving long-term security management.
Many newer devices already include these certificates.
Hardware manufacturers have begun shipping systems with the updated certificates embedded in firmware. As a result:
-
Devices purchased after 2024 will typically already contain the 2023 Secure Boot CAs.
Older devices, however, will need to receive the updated certificates through Windows updates or administrative deployment.
Recommended Windows versions
Microsoft recommends running Windows 11 version 24H2 or later for systems that will transition to the new Secure Boot certificate chain.
Newer Windows versions include the platform changes required to properly manage Secure Boot certificate updates and boot component validation under the new CA hierarchy.
Organizations still running older builds of Windows may find that the transition becomes significantly more complex.
How administrators can validate their devices
Before deploying any updates, administrators should first determine whether their endpoints already contain the necessary certificates.
Microsoft provides a validation script that can scan devices and generate a report showing the current Secure Boot configuration.
The script is available at:
aka.ms/getsecureboot
In enterprise environments this can be executed across devices through Microsoft Intune, allowing administrators to quickly determine which systems require updates.
The report will typically include:
-
Secure Boot status
-
Current certificate authorities present in firmware
-
Compatibility with the 2023 certificate chain
This step is essential for planning large-scale deployments.
Deployment options for enterprises
Organizations managing large fleets of Windows devices have several options for deploying the updated certificates.
Intune deployment
Administrators can configure Secure Boot updates through Microsoft Intune using Microsoft Update mechanisms.
Two primary approaches are available:
-
Microsoft Update Managed Opt-in
-
Secure Boot certificate update policies
These options allow administrators to gradually roll out the new certificates across managed devices.
Group Policy deployment
For environments using on-premises management, updates can also be controlled through Group Policy.
The relevant policy path is:
Computer Configuration
Administrative Templates
Windows Components
Secure Boot
This allows administrators to enable certificate updates and control how Secure Boot database changes are applied.
Windows Update delivery
Microsoft has also confirmed that upcoming Windows updates will include the necessary certificate updates.
In many cases the transition may occur automatically when devices install future cumulative updates, assuming Secure Boot update mechanisms are enabled.
Why organizations should prepare early
Although the certificate expiration occurs in October 2026, waiting until the last minute would be a mistake.
Boot infrastructure changes affect:
-
firmware
-
operating system components
-
update pipelines
-
security policies
Large organizations often require months of validation and staged deployment before implementing such changes across thousands of endpoints.
Starting validation early ensures that administrators can identify compatibility issues, firmware limitations or management gaps well before the deadline.
Final thoughts
The expiration of the original Secure Boot certificate chain marks the first major trust-anchor transition in the Windows boot ecosystem in over fifteen years.
While systems will continue functioning after 2026, organizations that fail to transition to the 2023 Secure Boot certificate authorities will gradually lose access to future boot-level security improvements.
For modern enterprise environments where firmware integrity and early-boot protections are increasingly important, keeping the Secure Boot infrastructure current is not optional — it is part of maintaining a secure platform.
Now is a good time to validate devices, review update policies and prepare for the transition.
The clock toward October 2026 has already started ticking.