On June 24, 2026, a 15-year-old cryptographic foundation of PC security reached its end of life. The Microsoft Corporation KEK CA 2011 certificate, a cornerstone of the Secure Boot ecosystem in hundreds of millions of Windows computers, expired at 00:00 UTC. For many users, this event passed without a whisper. For others—particularly those with aging hardware or neglected firmware—it introduced boot-time surprises ranging from Secure Boot disabling itself to outright boot failures.
The deadline marks the first major rollover of a Secure Boot Key Exchange Key (KEK) certificate in the history of the PC industry. Microsoft has been preparing for this moment for years, embedding a successor certificate into firmware starting in 2023 and pushing updates through Windows Update. Yet the patchwork of PC models, UEFI firmware maturities, and user awareness means the aftereffects will ripple for months.
Understanding Secure Boot and the KEK Certificate
Secure Boot is a UEFI firmware feature designed to prevent unauthorized code from running during the boot process. It checks every piece of boot software—from the firmware itself to the OS bootloader—against a database of trusted signatures. Only software signed with a key that chains back to a trusted root certificate is allowed to execute.
The Key Exchange Key (KEK) sits at the heart of this trust chain. It is the certificate that signs updates to the Secure Boot signature databases (the db and dbx). When Microsoft needs to add a new trusted bootloader, revoke a compromised one, or update the Secure Boot policy across millions of devices, it does so with a payload signed by the KEK. Without a valid KEK installed in the firmware, those updates cannot be verified. The system cannot distinguish a legitimate Microsoft-signed database update from a malicious one.
The Microsoft Corporation KEK CA 2011 certificate was issued in 2011 and baked into UEFI firmware on virtually every Windows 8, 8.1, 10, and early Windows 11 PC. It has a validity period of 15 years—until June 24, 2026. That expiration date was never a secret. It was predictable, immutable, and designed into the certificate from day one. The challenge for the ecosystem was always: how do you replace a foundational key that lives in millions of immutable firmware ROMs without breaking the very security mechanism that protects the boot?
The Transition: From 2011 to 2023 KEK Certificate
Microsoft’s answer arrived in 2023 with the creation of a new KEK certificate: Microsoft Corporation KEK CA 2023. This certificate extends validity until 2038, providing a long overlap window. The strategy was to pre-load the new KEK into firmware on all new PCs manufactured after approximately mid-2023, while simultaneously pushing firmware updates to older, in-support systems via Windows Update or through OEM-provided driver and firmware updates.
The dual-certificate approach allowed a seamless transition. During the overlap period (2023–2026), a properly updated firmware would contain both the 2011 and 2023 KEK certificates. It could verify signatures from either. When Microsoft eventually signed a Secure Boot database update exclusively with the 2023 KEK after June 24, 2026, those devices would accept it without issue. Systems that only possessed the 2011 KEK—and never received the new certificate—would see the update as invalid and would reject it.
Crucially, the expiration of the 2011 certificate does not mean it automatically stops working. X.509 certificate expiration in UEFI firmware is typically checked against the system’s real-time clock during signature verification. If the firmware validates the expiration date, any new database updates signed with the 2011 key after June 24, 2026 will be blocked. However, the key’s cryptoperiod ending also means Microsoft will no longer sign updates with it, a best practice that prevents compromising today’s updates with yesterday’s key material.
What the Expiration Means for Windows PCs
The practical impact depends on whether a system has accepted a new Secure Boot database update recently. On July 2026 Patch Tuesday, Microsoft began pushing a cumulative UEFI revocation update signed exclusively with the 2023 KEK. This update added newly revoked hashes to the dbx (signature blacklist) and was the first widespread test of the rollover.
On a well-maintained PC—one with both the 2011 and 2023 KEK in firmware—the update installed transparently. Secure Boot remained enabled, and the system rebooted normally. On a system that lacked the 2023 KEK, the firmware rejected the signed update package. Because the update could not be applied, Secure Boot entered a degraded state. Depending on the UEFI implementation, one of three things happened:
- The firmware silently skipped the update but kept Secure Boot enabled using the 2011 KEK, still booting Windows normally. However, the device was now missing critical revocations, leaving it vulnerable to known bootkits.
- The firmware disabled Secure Boot entirely to allow the system to boot, posting a warning to the user. Windows would load fine but without the protection Secure Boot normally provides.
- The firmware halted the boot process with a “Boot Device Not Found” or “Security Violation” error, particularly on systems where Secure Boot was a mandatory policy and not an option.
The third scenario is the most visible and disruptive. Users with older desktops, custom-built machines with outdated UEFI firmware, or those who had deferred all firmware updates suddenly found their PCs refusing to start. For enterprise IT departments, a flood of helpdesk tickets began arriving on the morning of July 15, 2026, the day after Patch Tuesday.
Which Systems Are Affected?
The risk profile is sharply divided by PC age and update hygiene. Generally:
- PCs manufactured after mid-2023 ship with both the 2011 and 2023 KEK certificates. Virtually all of these systems handle the rollover with zero intervention, provided they have received any subsequent firmware maintenance.
- PCs manufactured between 2016 and mid-2023 typically have the 2011 KEK only. Their ability to receive the 2023 KEK depends on whether the OEM published a UEFI firmware update and whether the user applied it. Many mainstream business laptops from Dell, HP, and Lenovo received such updates through Windows Update’s “Driver & Firmware” pipeline. Consumer devices that were no longer supported by their manufacturer, or those where the user actively blocked driver updates, are caught in the gap.
- PCs manufactured before 2016—including original Windows 8 machines and early Windows 10 laptops—are at highest risk. These systems are almost certainly out of OEM support. No firmware update containing the 2023 KEK was ever released for them. Microsoft’s only path to mitigation is via a generic Secure Boot update capsule distributed through Windows Update, but the capsule itself must be verified by a KEK trusted by the firmware. If the device trusts only the expired 2011 KEK, the capsule update to install the 2023 KEK would need to be signed by the 2011 KEK—something Microsoft will not do post-expiration.
A special case exists for virtual machines and Hyper-V guests. Virtualized UEFI firmware (such as in Hyper-V, VMware, and VirtualBox) often uses a base UEFI image that may be equally outdated. Administrators must update the virtual firmware manually or install a new VM generation to obtain the 2023 KEK trust anchor.
Microsoft’s Mitigation Strategy and Updates
Microsoft employed a multi-year, multi-layered strategy to minimize disruption. The cornerstone was early publication of the new KEK. In 2023, the company updated its Secure Boot documentation and released the Microsoft Corporation KEK CA 2023 certificate for OEMs to integrate. It also distributed signed firmware capsules through Windows Update to install the new certificate on as many in-market devices as possible.
For enterprise environments, Microsoft recommended that IT administrators deploy the KB5028998 and KB5034763 series of servicing stack updates, which included the new KEK as part of Windows’ boot manager trust store. While this does not install the certificate into UEFI firmware, it prepares the Windows-side boot infrastructure to work correctly once the firmware is updated.
The Windows 11 24H2 and later installations include the new KEK directly in the Windows boot manager’s own Secure Boot policy, enabling a so-called “Software KEK” that can bootstrap the firmware update even if the hardware UEFI never receives the 2023 certificate. This mechanism is complex and not universally supported, but it offers a last-resort path for some older systems.
One crucial nuance: the expiration itself is a UEFI-level event. Windows has no direct control over how the firmware enforces certificate expiry. Some UEFI implementations ignore certificate expiration entirely—they check only the signature chain, not the validity period. On those systems, even a database update signed with the 2011 KEK after June 24, 2026 might be accepted, because the firmware never consults the clock. However, Microsoft’s signing infrastructure has stopped issuing new signatures from the 2011 key, so this becomes a moot point for new updates.
User Action: Steps to Ensure Continued Secure Boot Protection
For most Windows users, the path forward is straightforward but urgent. Here’s what to do immediately:
- Check Secure Boot status: Reboot into UEFI settings (typically by pressing F2, Del, or Esc during POST). Confirm that Secure Boot is enabled and that no warnings are present. In Windows, run
System Information(msinfo32) and look for “Secure Boot State”—it should read “On.” - Verify firmware version: Open
Device Manager, expand “Firmware,” and note the current firmware version. Compare it with the latest available on your PC manufacturer’s support site. If an update from 2023 or later is listed, install it. Many OEMs have published a specific bulletin about Secure Boot 2026 readiness—search for “Secure Boot KEK 2026” plus your model name. - Allow Windows Update to deliver firmware: In Windows Update, under Advanced Options, ensure “Receive updates for other Microsoft products” is enabled. Firmware capsules often are classified as driver updates, and they may fail to install if this toggle is off.
- Apply any pending UEFI revocations: Check Windows Update history for “Security Update for Secure Boot” (KB5034763 or later). If present, the update likely installed successfully, indicating your firmware already trusts the 2023 KEK. If the update failed with error 0x8024a112 or 0x800f0922, your firmware lacks the new key.
- For enterprise PCs: Use Microsoft Endpoint Manager or third-party UEFI management tools to deploy the firmware update at scale. Check with your hardware vendor for packaged firmware installers that can be pushed via Configuration Manager.
Systems that cannot install the 2023 KEK via firmware are not completely without options. Some motherboards allow manual addition of KEK certificates through a “Secure Boot Key Management” menu. Microsoft makes the public portion of the 2023 KEK available on its documentation site; technically adept users can load it as a new KEK entry. This is not for the faint of heart—incorrect manipulation can brick Secure Boot or lock out the system.
Potential Pitfalls and What to Watch For
Beyond the immediate boot failures, several secondary effects are emerging. Antivirus and endpoint protection platforms that rely on Secure Boot policies for tamper protection may report degraded security status. Windows Defender System Guard will flag the absence of the latest revocations. Microsoft Intune and other mobile device management platforms may mark such devices as non-compliant, potentially revoking access to corporate resources.
Another subtle issue: some older PCs use an OEM-provided Secure Boot factory reset tool that reinstalls only the 2011 KEK. After a factory reset of the UEFI Secure Boot settings, those systems would lose the 2023 KEK even if it had been previously installed. Users performing such a reset must re-apply the firmware update.
Linux dual-boot configurations face their own challenges. Many Linux distributions use a shim signed by Microsoft’s third-party UEFI CA. That shim itself is not directly affected, but if the system’s Secure Boot enforcement is weakened due to the KEK rollover, Linux boots may become less secure or require disabling Secure Boot entirely—an undesirable workaround.
Virtual machine environments need attention. Cloud providers like Azure and AWS updated their default UEFI firmware images long ago, but self-hosted virtual machines running older Hyper-V versions (pre-2023) may still use the 2011-only firmware. Creating a new VM from scratch with an updated guest OS image is often the simplest fix.
The Bigger Picture: Why This Rollover Matters
The Secure Boot ecosystem is a delicate trust infrastructure that few users think about until it breaks. The expiration of the Microsoft Corporation KEK CA 2011 certificate is not a failure of planning—it is a testament to a deliberate, long-term design. By baking certificate lifetimes into the system, the industry ensures that cryptographic keys are periodically replaced, a crucial defense against undiscovered attacks on aging key material.
The 2026 rollover is only the beginning. The Microsoft Windows Production PCA 2011 certificate, which signs all Windows boot components, expires in 2030. Plan the next transition now. The Microsoft UEFI CA 2011 certificate, another chain element, will expire in 2034. Each expiration will force another round of firmware updates and another test of the ecosystem’s readiness.
What the June 24, 2026 expiration exposed is the vast tail of active but poorly maintained hardware. A significant fraction of Windows PCs—perhaps 10-15% by some industry estimates—never received the 2023 KEK. These are often machines in homes, small businesses, and education sectors where firmware updates are seen as optional, or where IT resources are too thin to manage them.
Staying Ahead of the Next Certificate Expiration
For end users, the lesson is simple: treat firmware updates as seriously as OS updates. UEFI is not a static BIOS ROM anymore; it is a managed component that must evolve. Enable automatic firmware updates through Windows Update and check your manufacturer’s site periodically.
For IT professionals, the 2026 KEK rollover is a wake-up call to inventory hardware firmware state, push updates via MSI or CSP, and build compliance policies that flag missing critical UEFI certificates. The next expiration in 2030 may not offer the same long overlap period, and the consequences of inaction will compound.
The death of a fifteen-year-old certificate on an ordinary summer day in 2026 was a quiet milestone for most, but it underscored a fundamental truth of modern computing: security is a process, not a product. Keeping the boot chain intact requires vigilance, and the next deadline is already on the horizon.