Microsoft's Secure Boot certificates from 2011 are expiring through 2026, and the one that signs the Windows boot manager, Microsoft Windows Production PCA 2011, reached its expiry date on 19 October 2026.

What happened

The 2011 trust anchors in the UEFI Secure Boot databases are being replaced by 2023 equivalents: Microsoft Corporation KEK 2K CA 2023 in the KEK store and Windows UEFI CA 2023 in the DB store. The KEK CA 2011 and Microsoft UEFI CA 2011 certificates already expired on 24 and 27 June 2026. Microsoft pushes the replacements through Windows Update on most devices, but firmware limits, imaging templates and offline machines can leave a device on the old chain.

Devices that miss the update still boot and still install ordinary Windows updates. What they lose is future Secure Boot servicing: boot manager updates, DB and DBX changes, revocation lists and mitigations for new boot-level vulnerabilities.

Who is affected

Any Secure Boot enabled Windows device or VM that has not yet received the 2023 certificates.

• Physical PCs and servers whose OEM has not shipped a firmware update carrying the new KEK and DB entries
• Hypervisor and cloud VM templates built from older images, including Windows Server 2016 to 2022 templates
• Devices kept off Windows Update or imaged from a golden image captured before mid-2026
• BitLocker and measured-boot setups, which depend on Secure Boot trust staying serviceable

What to do now

Inventory Secure Boot status across the fleet this week and fix the devices still on the 2011 chain, before the next boot-level patch needs the new keys.

• Check HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing\UEFICA2023Status and confirm it reads Updated
• Watch for System event log entries 1795 and 1801, which indicate certificate remediation has not been applied
• Install current OEM firmware where the vendor supplies it, then let Windows Update finish the DB and KEK work
• Rebuild VM templates from updated images so new deployments do not start life on expiring keys
• Record the assets that cannot be fixed, because those will not take future boot security updates

What this means for South African businesses

This is the quiet kind of exposure: nothing breaks on the day, so it drops off the list. Older desktops and long-lived servers are common in South African SMEs, and hardware that no longer gets BIOS updates from the vendor is exactly where the 2011 chain sticks. The practical risk is not today's phishing mail; it is that boot-level fixes quietly stop applying to part of the fleet while everyone assumes patching is current.

Source: Microsoft Support, Windows Secure Boot certificate expiration and CA updates.

Also on the blog

• Chrome 156 fixes 353 flaws, six of them critical
• OVHcloud CLI 0.11.0 to 0.15.0 shipped a credential stealer

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.