Windows 11 Secure Boot certificates: the last 2011 one expired on October 19 — how to check yours in Windows Security, and did your PC get the 2023 update?

Microsoft's original 2011 Secure Boot certificates began expiring in June 2026, and the last one on Microsoft's list, Windows Production PCA 2011, was due to expire on October 19, 2026. Your PC still boots, so how do you know whether it received the 2023 replacements? Here is what Microsoft says and the checks I would like you to run and report back.

Video: "Windows Security App Now Lets You Check if Your Secure Boot Certificates Are up to Date!", BrenTech (Britec) YouTube channel, published April 3, 2026, 4 min 20 s. It is a third-party walkthrough, not an official Microsoft video: https://www.youtube.com/watch?v=_U67ZnBA6WQ

What Microsoft's documentation says:

• Devices without the new certificates keep starting and keep installing standard Windows updates. They stop receiving new early-boot protections (Boot Manager, Secure Boot databases and revocation lists, fixes for boot-chain vulnerabilities). Microsoft says not to disable Secure Boot to work around this (Microsoft Support KB5079373, published Feb 10, 2026).
• Expiry dates listed by Microsoft: KEK CA 2011 on June 24, 2026; UEFI CA 2011 on June 27, 2026; Windows Production PCA 2011 on October 19, 2026.
• Since April 2026, Windows Security > Device security > Secure Boot shows the update status. Green means no action is needed, yellow means a recommendation, red means urgent attention. Microsoft warns that a green check alone does not confirm anything: read the text, which should say "Secure Boot is on and all required certificate updates have been applied" (Microsoft Support KB5087130).
• The badge changes are off by default on enterprise-managed devices, and dismissing a warning resets the badge (same page).
• Windows 11's November 10, 2026 update KB5132061 adds more "high confidence device targeting data" so more PCs are eligible to receive the new certificates automatically, with rollout continuing "in the coming months" (Microsoft Support, Nov 10, 2026).
• Some PCs may need an OEM firmware (BIOS/UEFI) update, which may only exist for devices still in their support period.

A community-written check (MakeUseOf, Nov 6, 2026, one author's tests on four PCs, not Microsoft guidance): in an admin PowerShell, [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023' returns True if the certificate is in the firmware; and System event ID 1808 in Event Viewer appears once the required certificates and the new boot manager are applied. The author notes that True with no event 1808 means "halfway there." I have not tested this myself.

Questions for the community:

1. What does Windows Security show on your PC: green with the full sentence, yellow, red, or no Secure Boot card at all?
2. If yellow, did installing updates and restarting (once or twice) turn it green? Did you need a BIOS/UEFI update, and from which brand?
3. Did you find event ID 1808 in Event Viewer?
4. Is Secure Boot off on your PC? Many recent PC games and anti-cheats ask for it, so tell us whether you turned it on and what happened.
5. Did anything break after the update: BitLocker recovery prompt, boot error, dual-boot or old install USB failing?

Please give your Windows version (25H2, 26H2...), PC or motherboard brand and the exact status text. Back up your BitLocker recovery key before changing firmware settings.
Note: I did not read an official Microsoft statement about specific games being affected by this certificate change, so please report only what you observed.
Image: thumbnail of the BrenTech YouTube video (640x480, the highest resolution available for this video). © BrenTech.
Sources: Microsoft Support, "Secure Boot certificate update status in the Windows Security app" (KB5087130), published Apr 2, 2026, read Nov 13, 2026 https://support.microsoft.com/en-us/servicing/os/secure-boot/2026/03/secure-boot-certificate-update-status-in-the-windows-security-app ; Microsoft Support, "When Secure Boot certificates expire on Windows devices" (KB5079373), Feb 10, 2026, read Nov 13, 2026 https://support.microsoft.com/en-us/servicing/os/secure-boot/2026/02/when-secure-boot-certificates-expire-on-windows-devices ; Microsoft Support, "Windows Secure Boot certificate expiration and CA updates" (expiry table), read Nov 13, 2026 https://support.microsoft.com/en-us/servicing/os/secure-boot/2025/06/windows-secure-boot-certificate-expiration-and-ca-updates ; Microsoft Support, "November 10, 2026—KB5132061", read Nov 13, 2026 https://support.microsoft.com/en-us/servicing/os/windows-11/2026/11/kb5132061-windows-11-24h2-25h2-26h2-security-update ; MakeUseOf, Nov 6, 2026 https://www.makeuseof.com/microsofts-last-old-secure-boot-certificate-just-expired-so-i-checked-whether-my-pcs-got-the-new-ones/
#windows-11

Version française : https://tricknfix.com/fr/sujet/windows-11-et-certificats-secure-boot-le-dernier-de-2011-a-expire-le-19-octobre-comment-verifier-si-votre-pc-a-recu-les-certificats-2023-0746a46b46/