On July 14, 2026, Microsoft released cumulative update KB5101650 for Windows 11, advancing builds 25H2 and 24H2 to 26200.8875 and 26100.8875, respectively. Tucked into the release notes was a critical reassurance: devices still awaiting the new 2023 Secure Boot certificates will continue to boot normally, receive regular Windows updates, and get the certificates pushed automatically “in the coming months.”
That message arrived just weeks after the first legacy certificate—Microsoft Corporation KEK CA 2011—expired on June 24, followed by Microsoft UEFI CA 2011 on June 27. A third, the Windows Production PCA 2011, is set to expire October 19. For the millions of Windows 11 PCs still running on the 2011 trust chain, the update confirms there is no immediate danger of a startup failure. But it also underscores a long-running, complex transition that every Windows user should understand.
The Patch Tuesday Reassurance
The core news from KB5101650 is simple: a missed certificate update is not a death sentence for your PC. Microsoft explicitly wrote, “Devices that haven’t received the newer certificates will continue to start, and standard Windows updates will continue to install.” The same statement noted that Microsoft will keep installing the 2023 certificates via Windows Update over the coming months.
That’s a notable commitment. The company has been rolling out these certificates since 2024, but compatibility challenges with the vast diversity of PC firmware have forced a phased approach. By mid-2026, many devices had not yet been moved to the new trust chain, and the June expirations prompted fears of widespread boot failures. KB5101650 puts those fears to rest while keeping the automated deployment path open.
Your Device Status: Green, Yellow, or Red
Since April 2026, Windows Security has offered a straightforward way to check your Secure Boot certificate status. Open the app, go to Device security > Secure Boot, and you’ll see one of three indicators.
- Green checkmark: Your device already has the 2023 certificates, and the updated boot manager is installed. No action is needed.
- Yellow warning: Windows is still using the 2011 chain, often because the rollout is awaiting more compatibility data for your firmware, or the update hasn’t been offered yet. This is not a crisis. Keep Windows Update running and restart when prompted.
- Red alert: Your firmware cannot apply the certificate update, typically due to an incompatibility that requires a BIOS/UEFI update from your PC manufacturer.
A red status is the only one that demands immediate action. Visit your manufacturer’s support site, download the correct firmware package for your exact model, and follow their instructions. If Windows Security says your hardware doesn’t support the automated update, Microsoft advises contacting the manufacturer directly.
Why This Matters for Boot-Level Security
Secure Boot is the UEFI feature that verifies the digital signatures of every piece of code before Windows loads. It’s your PC’s first line of defense against bootkits and rootkits—malware that can hide from traditional antivirus because it runs earlier in the startup sequence.
The 2011 certificates have underpinned this system since Windows 8. After 15 years, cryptographic best practices demand a refresh. The 2023 certificates not only modernize the keys but also split responsibilities more finely, separating trust for third-party bootloaders from option-ROMs, for instance. More importantly, once a device is on the new chain, Microsoft can continue to push DBX (Disallowed Signature Database) updates—the revocation list that blocks known vulnerable or malicious bootloaders.
Without the 2023 certificates, a PC can still boot and run applications, but it may lose access to future DBX updates and other early-boot mitigations. The 2023 BlackLotus UEFI bootkit demonstrated exactly how attackers can exploit older, signed boot components to bypass Secure Boot until those signatures are revoked. Staying current is therefore a real security concern, not just a housekeeping task.
The Rocky Road to Certificate Renewal
This transition has not been seamless. Writing new certificates to firmware is far more delicate than a typical Windows patch. The update must touch UEFI variables, boot files, and revocation databases, all while avoiding BitLocker recovery prompts or boot failures.
Throughout 2025 and 2026, Microsoft paused the rollout on specific device and firmware combinations that caused problems. HP, for instance, admitted that a batch of its BIOS updates in April 2026 triggered BitLocker recovery loops on commercial laptops. Dell, Lenovo, and others published end-of-service-life cutoffs, leaving many older PCs permanently on the 2011 chain if they can’t receive a necessary firmware update.
Multiple restarts after installing monthly updates are normal during this process. Each step—writing new certificates, applying the updated boot manager, and booting with the new trust chain—may require its own reboot. A new C:\Windows\SecureBoot folder also appears on eligible systems; it contains PowerShell scripts for IT admins, not malware.
For enterprise administrators, inventory tools must now account for firmware model, firmware revision, certificate state, and BitLocker recovery readiness. Microsoft’s guidance points to the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot where UEFICA2023Status = Updated signals success, as well as Event Viewer IDs such as 1808 (successful update) and 1801 (incomplete update).
Windows 10 is part of the same certificate transition, but only devices enrolled in Extended Security Updates (ESU) can receive the monthly patches that carry it. Unsupported Windows 10 PCs will continue to boot but won’t get the new certificates or future DBX updates.
What You Should Do Right Now
For the vast majority of Windows 11 users, the practical steps are straightforward and non-disruptive.
- Check your status in Windows Security. A green checkmark means you’re done; a yellow warning means wait.
- Keep Windows Update on. The continuing rollout depends on regular servicing, so do not pause updates.
- Restart when prompted. Multiple reboots are expected during the transition.
- Update your BIOS/UEFI if Windows Security shows a red alert or if your manufacturer has released a relevant firmware update. Always use the package from the official support site.
- Secure your BitLocker recovery key before any firmware work. Confirm it is accessible via your Microsoft account, Entra ID, or your organization’s escrow process.
- Do not manually reset Secure Boot keys. Factory defaults or manual deletion can complicate recovery and may not resolve the issue.
IT administrators should monitor the registry and event logs, pilot firmware updates on representative hardware, and engage with OEM support if specific models remain stuck.
The Outlook: Staying Protected
Microsoft’s latest update confirms that the Secure Boot certificate rollout will continue well beyond the initial expiration dates. That is good news. It means the company is committed to getting the 2023 certificates onto as many supported devices as possible, treating the transition as a sustained servicing operation rather than a one-time event.
The remaining risk is a slow erosion of boot-level defenses on PCs that cannot move to the new chain. Without the ability to receive DBX updates, those systems will become increasingly vulnerable to new bootkits. For now, keep an eye on that Windows Security indicator. If it stays green or eventually turns green, you’re protected. If it remains red after all reasonable firmware update attempts, it may be time to consider a hardware refresh to ensure your PC’s most fundamental security layer stays intact.