Secure Boot's October 2026 Deadline: Two Years' Notice Wasn't Enough
The deadline nobody missed Every expiry story we've written here has the same shape. A certificate lapses, nobody was watching, something breaks, and everyone is surprised. A Splunk license at a federal agency. Microsoft's own network connectivity tool. Same plot, different logo. This one is the opposite, and that's what makes it worth reading. On October 19, 2026, roughly ten weeks from this writing, the Microsoft Windows Production PCA 2011 certificate expires. It sits under the trust chain for the Windows boot process on essentially every PC shipped in the last fifteen years. Nobody forgot it. The expiry date has been printed inside the certificate since 2011. Microsoft has been publishing guidance for over two years, shipping replacement certificates through Windows Update since 2024, running OEM briefings, and pushing an automatic rollout that requires most users to do nothing at all. It is August. It still isn't done. What's actually expiring Three certificates, four replacements, three dates, all in 2026: Certificate Expires Replaced by Microsoft Corporation KEK CA 2011 June 24, 2026 Microsoft Corporation KEK 2K CA 2023 Microsoft Corporation UEFI CA 2011 June 27, 2026 Microsoft UEFI CA 2023 Microsoft Corporation UEFI CA 2011 June 27, 2026 Microsoft Option ROM UEFI CA 2023 Microsoft Windows Production PCA 2011 October 19, 2026 Windows UEFI CA 2023 Both June dates have already passed. October is the one that matters most, because that's the certificate used to sign the Windows Boot Manager itself. Devices that don't pick up the 2023 certificates keep booting and keep taking normal Windows updates. What they lose is the ability to receive new protections for the early boot path: updates to Boot Manager, Secure Boot database changes, revocation lists, and mitigations for bootkit vulnerabilities discovered from here on. In other words, the machine doesn't fail. It just quietly stops being patchable in the one layer that sits below your antivirus, your EDR agent, a