How to Check Your Secure Boot Certificate Update Before October 19

A Secure Boot certificate update is the one Windows chore with a hard calendar date attached this month. Microsoft Windows Production PCA 2011, the certificate that signs the Windows boot loader, expires on October 19, 2026, nine days from now. The other 2011-era Secure Boot certificates lapsed in June, which makes this the last of the three.

The stakes need calibrating. Microsoft says devices without the 2023 certificates keep booting and keep receiving ordinary Windows updates. What they lose is the ability to receive new boot-level protections, such as boot manager updates and Secure Boot DB and DBX updates. The documentation describes a gradual loss of protection, not a boot failure on the day.

For most home PCs the work is already done or on its way. Microsoft’s September 2026 security update, released September 8, expanded the data Windows uses to decide which devices can receive the new certificates automatically, and the release-health note adds that some devices may see one extra restart after the certificate update is applied. Plenty of machines still need a nudge, a firmware update or an explanation. This guide shows how to tell which group yours is in.

Which Certificates Expire, and What Replaces Them

The table follows Microsoft’s Secure Boot certificate expiration article. Some third-party guides give June 24 for the UEFI CA 2011, while Microsoft’s table says June 27, so go with Microsoft. The article also explains that the two UEFI CA 2023 certificates separate boot loader signing from option ROM signing.

Windows needs both the Secure Boot DB and the KEK updated to the 2023 versions. Many devices receive them automatically through Windows Update, and many manufacturers ship firmware updates when the existing firmware cannot accept them.

Step 1: Confirm Secure Boot Is On

Everything below applies only to PCs that boot with UEFI and have Secure Boot enabled. System Information (msinfo32) lists the Secure Boot state, and PowerShell gives a plain answer from an elevated prompt.

Confirm-SecureBootUEFI

False means Secure Boot is off, and the certificate question does not apply until you turn it on. An error saying the cmdlet is unsupported usually means the PC boots in legacy BIOS mode.

Step 2: Read the Status in Windows Security

The fastest check needs no commands. Open Windows Security, choose Device security, and open the Secure Boot section. Windows Latest describes three states. A green check means the certificates are fully updated. A yellow icon means Windows is waiting for more compatibility data, and a red icon usually points to a firmware issue.

Yellow calls for patience, so keep Windows Update running. Red calls for a BIOS or UEFI update from the PC maker, after which Windows retries on its own.

Step 3: Check the Registry Status

For a scripted answer, Windows records its progress in the registry. Microsoft documents the values in its support article KB5068202.

$servicing = "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing"
Get-ItemProperty -Path $servicing | Select-Object UEFICA2023Status, UEFICA2023Error, UEFICA2023ErrorEvent

Updated is the answer you want. As a cross-check, a third-party guide from Adam the Automator searches the DB variable for the new certificate by name. It is not Microsoft documentation, so treat the result as supporting evidence rather than proof.

$db = Get-SecureBootUEFI -Name db
[System.Text.Encoding]::ASCII.GetString($db.Bytes) -match "Windows UEFI CA 2023"

Step 4: Read the Event Log

The richest evidence sits in the System log, where Secure Boot events appear under the source TPM-WMI, as listed in Microsoft’s Secure Boot DB and DBX variable update events article. One third-party guide points to a separate operational log named Microsoft-Windows-SecureBoot-Updates, so check there too if the System log looks empty.

Get-WinEvent -FilterHashtable @{LogName="System"; ProviderName="TPM-WMI"} -MaxEvents 30 |
  Format-Table TimeCreated, Id, LevelDisplayName, Message -AutoSize

Read a 1801 as unfinished business, not as a failure. Its confidence field tells you how Windows currently rates the device, and a rating of Needs More Data or Paused means the rollout is waiting on signals.

Step 5: Fix the Common Blockers

Install the firmware update first

Events 1795 and 1796 and a red icon all point toward firmware. Look on the PC maker’s support page for a BIOS or UEFI release, install it, and let Windows retry. On managed fleets, update firmware before deploying certificates, and expect more than one restart.

Handle BitLocker deliberately

Event 1032 means Windows held the update back to avoid pushing the machine into BitLocker recovery. Microsoft’s documented fix suspends protection for two restarts and then turns it back on. Keep your recovery key reachable before you start, and run the commands from an administrator prompt.

Manage-bde -Protectors -Disable %systemdrive% -RebootCount 2
# restart twice, then confirm protection resumed
Manage-bde -Protectors -Enable %systemdrive%

Trigger the update manually, only if you must

Microsoft documents a manual path for administrators. Setting the AvailableUpdates registry value to 0x5944 requests every relevant update: the 2023 certificates, the KEK and the new boot manager. A scheduled task named \Microsoft\Windows\PI\Secure-Boot-Update runs about every 12 hours and applies it, and you can start it by hand.

$sb = "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot"
Set-ItemProperty -Path $sb -Name "AvailableUpdates" -Value 0x5944 -Type DWord
Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
# When AvailableUpdates reads 0x4100, restart and run the task again

In Microsoft’s test procedure the value moves to 0x4100, a manual restart follows, and a second run of the task brings it to 0x4000. Setting the value does not itself restart the PC. Home users generally should not need this, since Windows applies the certificates in a controlled, phased way and waits for successful update signals. Forcing it skips that caution, so pilot on one machine, update firmware first, and keep a backup.

Mind recovery media, dual boot and virtual machines

Treat the change as one-way. A third-party guide warns that older recovery media and deployment images may not boot on updated devices, so check Microsoft’s guidance for your scenario before assuming they will. Dual-boot setups deserve a look too, because the UEFI CA 2011 signs third-party boot loaders. The Windows message center also lists an item on Secure Boot certificate updates for Linux on Azure VMs. For virtual machines in general, Windows Latest reports that the KEK step can fail when the virtual firmware lacks a valid platform key, which shows up as event 1803. Microsoft’s event article does not cover that event, so confirm with your hypervisor vendor.

A Note on the Revocation Step

Microsoft’s event article describes a separate DBX update that revokes the 2011 certificate, logged as event 1037, after which boot applications signed with it are no longer trusted. That update fails on purpose when the Windows UEFI CA 2023 is missing from the DB or the boot manager is not signed with it, logging events 1797 and 1798. The ordering works as a guard rail, since the revocation refuses to proceed until the replacement is in place. Nothing in this checklist requires you to trigger it.

Common Questions

Will my PC stop booting on October 19?

Microsoft says it will not. Devices without the 2023 certificates still boot and still receive standard Windows updates, but they cannot receive new boot-level protections.

Do Windows 10 PCs need this as well?

Supported Windows 10 builds are in scope. Windows Latest reported that the June 2026 update, KB5094126, widened the rollout to more Windows 11 and Windows 10 devices, and Microsoft’s registry article lists Windows 10 version 1607 among supported products. Confirm your own build against the Applies To list in Microsoft’s articles.

Should I turn Secure Boot off to avoid the whole thing?

That trades a certificate chore for a bigger security gap. The University of Wisconsin’s IT knowledge base calls keeping Secure Boot enabled generally best practice on UEFI devices that support it.

Is there another update before the 19th?

October Patch Tuesday falls on the 13th, so one more cumulative update should arrive first. I have not seen its release notes, so read them when they appear to see whether they change the Secure Boot rollout.

Sources

• Windows Secure Boot certificate expiration and CA updates, Microsoft Support
• Secure Boot DB and DBX variable update events, Microsoft Support (KB5016061)
• Registry key updates for Secure Boot, Microsoft Support (KB5068202)
• Windows message center, Microsoft Learn (message 4945, September 8, 2026)
• Windows Latest, June 14, 2026
• Windows Latest, September 10, 2026
• How to Survive the 2026 Secure Boot Certificate Expiry, Adam the Automator
• Microsoft Secure Boot Certificate Expiration 2026, University of Wisconsin KB