Your windows 11 secure boot cert dies in june 2026—check now or boot unprotected

Circle this date: June 14, 2026. That morning your PC could greet you with a silent red flag—Secure Boot’s 2011-era certificates expire, and every boot after that happens with the door half-open to bootkits like BlackLotus. Microsoft will push new 2023-era roots through Windows Update, but only if your firmware still listens. Miss the window and the machine you trust to start clean will start blind.

Why a 15-year-old signature still rules your mornings

Secure Boot is the bouncer that checks ID at UEFI level. When power hits the silicon, firmware scans every EFI binary against a whitelist burned into its key store. If the binary is countersigned by Microsoft Corporation KEK CA 2011, the firmware lets it run; if not, boot halts. After June 2026 that key becomes decorative—no revocation, no replacement, no second line. An attacker with a stolen EV code-signing cert can slip a malicious bootloader past a dead bouncer while Windows smiles and loads normally. Antivirus never gets a shot because the OS itself is already compromised.

Redmond has staged the rollover: UEFI CA 2011 expires first, Windows Production PCA 2011 follows in October. The replacement certificates—issued in 2023 and already living inside newer devices—will be delivered automatically, yet only on hardware that keeps Secure Boot toggled on and enrolled in the standard Microsoft KEK. Turn it off once to install a Linux distro or a “harmless” overclock tool and the update pipe breaks. The firmware will age in place like milk.

Two clicks tell if you’re on the guest list

Press Win+R, type msinfo32, hit Enter. The line labeled “Secure Boot State” must read On. Anything else—Off, Unsupported, Setup—and June 2026 becomes your personal zero-day. Fixing it is usually a five-minute trip: Settings → Recovery → Advanced startup → Restart → Troubleshoot → Advanced options → UEFI Firmware Settings. Hunt the Security tab, flip Secure Boot from Disabled to Enabled, save, reboot, recheck msinfo32. If the option is greyed out, your motherboard vendor already ships a firmware update that re-enrolls the 2023 keys; install that first.

Corporate fleets face a bigger headache. IT tools that chain-boot custom images often rely on the 2011 certificates being static. Admins must re-sign those images with the new 2023 hierarchy or watch mass blue-screens on Patch Tuesday 2026. Home users running Windows 10 on extended support get no rescue; the OS stops receiving security updates the same month the certificates die. The overlap is a coincidence Microsoft probably enjoys.

Bottom line: the calendar is doing what no hacker has—setting a hard expiration on trust. Check once, patch once, and you can forget the date. Ignore it and your PC becomes a time capsule running code no one vouches for.