A behind-the-scenes security deadline arrives next Wednesday, June 24, when the first of Microsoft's 2011-era Secure Boot certificates officially expires. Microsoft is updating the Secure Boot certificates originally issued in 2011 to ensure Windows devices continue to verify trusted boot software, and these older certificates begin expiring in June 2026. Devices that haven't received the newer 2023 certificates will continue to start and operate normally, and standard Windows updates will continue to install, but those devices will no longer be able to receive new security protections for the early boot process, including updates to Windows Boot Manager, Secure Boot databases, revocation lists, or mitigations for newly discovered boot-level vulnerabilities. In plain English: your PC won't break, but it could quietly fall behind on a critical layer of protection.
What's actually expiring on June 24
Secure Boot is a UEFI firmware feature that checks your PC's boot software before Windows even starts loading. It relies on cryptographic certificates baked into your motherboard, and three of those certificates are timing out this year. Microsoft Corporation KEK CA 2011 expires June 24, 2026. Microsoft Corporation UEFI CA 2011 expires June 27, 2026. Microsoft Windows Production PCA 2011 expires October 19, 2026. These are replaced by their 2023 equivalents, including Windows UEFI CA 2023 and Microsoft Corporation KEK 2K CA 2023.
The first Microsoft Secure Boot certificate from the Windows 8 era expires on June 24, 2026, beginning a staged retirement of 2011 trust anchors that still underpin boot security on many Windows PCs, servers, and embedded systems. The transition covers both Windows 10 and Windows 11 machines, including many older desktops we see come into our walk-in repair shop from homes and small offices around York County.
Will my PC stop working?
No. It's not a Y2K-style cliff. Your PC will not suddenly refuse to start. According to Microsoft, Dell, and other vendors, a device that reaches the deadline without the 2023 certificates will still boot and operate normally, and standard Windows updates will keep installing.
The risk is slower-moving. Machines that keep starting normally can slide into a degraded security state where future boot-level fixes no longer arrive. That makes this deadline less like a Y2K-style cliff and more like a warranty expiring on the part of Windows security most users never see. Over time, that means more exposure to bootkits and other low-level malware that load before Windows does — the kind of infection that's far harder to clean up later and sometimes requires a full rebuild or professional malware removal.
How to check your PC before the deadline
Windows 11 now tells you if your Secure Boot certificates have already been enabled or if it needs your attention. In most cases, for regular users, rest assured that your PC has already received the 2023 certificates several months before. Microsoft began rolling the new certificates out in phases back in 2024, and many PCs manufactured since then already have them — so a large share of users are already covered without realizing it.
Microsoft estimates the full update process takes roughly 48 hours and one or more restarts to complete, since the Boot Manager swap is deferred until your next natural reboot — so don't expect it to finish in one sitting. One reassurance: if you've noticed a new Secure Boot-related folder appear on your Windows 11 system, Microsoft has confirmed that's part of this rollout and not a bug — don't delete it.
The simplest steps for a home user: make sure Windows Update is current, install the June 9 Patch Tuesday updates, and leave the PC powered on long enough to fully restart over a couple of days. Older systems — especially aging Windows 10 desktops or laptops that haven't been updated in a while — are the ones most likely to need hands-on attention, and in some cases the right answer is a fresh SSD and memory upgrade instead of nursing along very old hardware.
What This Means for York, PA
If you own an older Windows 10 or 11 PC in York County and aren't sure whether your machine has received the 2023 Secure Boot certificates, bring it by York Computer Repair at 2069 Carlisle Rd before the June 24 deadline and we'll check it on the spot. Small businesses with several aging workstations should especially get ahead of this — boot-level malware is one of the worst things we clean up after.