Windows Secure Boot certificate expiration and CA updates1.docx

Windows Secure Boot certificate expiration and CA updates

The impact of Secure Boot certificate expiration

 

Microsoft is updating the Secure Boot certificates originally issued in 2011 to ensure Windows devices continue to verify trusted boot software. These older certificates begin expiring in June 2026. Devices that haven’t received the newer 2023 certificates will continue to start and operate normally, and standard Windows updates will continue to install. However, these devices will no longer be able to receive new security protections for the early boot process, including updates to Windows Boot Manager, Secure Boot databases, revocation lists, or mitigations for newly discovered boot level vulnerabilities.

Over time, this limits the device’s protection against emerging threats and may affect scenarios that rely on Secure Boot trust, such as BitLocker hardening or third-party bootloaders. Most Windows devices will receive the updated certificates automatically, and many OEMs provide firmware updates when needed. Keeping your device current with these updates helps ensures it can continue receiving the full set of security protections that Secure Boot is designed to provide.

Windows Secure Boot certificate expiration and CA updates

---

Windows Secure Boot certificate expiration and CA updates

What is Secure Boot?

Secure Boot is a security feature in Unified Extensible Firmware Interface (UEFI) based firmware that helps ensure that only trusted software runs during a device's boot (start) sequence. It works by verifying the digital signature of pre-boot software against a set of trusted digital certificates (also known as certificate authority or CA) stored in the device's firmware. As an industry standard, UEFI Secure Boot defines how platform firmware manages the certificates, authenticates firmware, and how the operating system (OS) interfaces with this process. For more details on UEFI and Secure Boot, please see Secure boot.

Secure Boot was first introduced in Windows 8 to protect against the emerging pre-boot malware (also known as a bootkit) threat at that time. As part of platform initialization, Secure Boot authenticates firmware modules before execution. These modules include UEFI firmware drivers (such as Option ROMs), boot loaders, and applications. As the final step of the Secure Boot process, the firmware verifies if Secure Boot trusts the boot loader. Then, the firmware passes control to the boot loader, which in turn verifies, loads into memory, and starts the Windows OS.

Secure Boot defines trusted code through a firmware policy set during manufacturing. Changes to this policy, such as adding or revoking certificates, are controlled by a hierarchy of keys. This hierarchy starts with the Platform Key (PK), typically owned by the hardware manufacturer, followed by the Key Enrollment Key (KEK) (also known as Key Exchange Key), which may include a Microsoft KEK and other OEM KEKs. The Allowed Signature Database (DB) and the Disallowed Signature Database (DBX) determine which code can run in the UEFI environment before the OS starts. The DB includes certificates managed by Microsoft and the OEM, while the DBX is updated by Microsoft with the latest revocations. Any entity with a KEK can update the DB and DBX.

 

Windows Secure Boot UEFI Certificates Expiring June 2026

Windows Secure Boot UEFI Certificates Expiring June 2026

Introduction

For IT administrators responsible for managing Windows devices, a crucial certificate update milestone is coming in June 2026 that could result in degraded security for systems that are not updated. Specifically, the Microsoft certificates that manage UEFI Secure Boot trust will expire, potentially allowing untrusted or malicious software to load on affected machines during system boot.

Secure Boot

Windows Secure Boot is a UEFI firmware security feature that ensures a computer boot only with trusted, digitally signed operating system loaders and drivers, preventing malicious code (such as rootkits or compromised bootloaders) from loading during startup. Introduced with Windows 8, it verifies the cryptographic signatures of boot components against a database of authorized keys, blocking unauthorized or tampered software to protect system integrity from the earliest stages of boot.

Chain of Trust

The UEFI Platform Key (PK) is the ultimate root of trust in Secure Boot. It is a single public key owned by the device manufacturer and stored in firmware. The PK certificate signs the Key Exchange Key (KEK) and grants authority to modify the other Secure Boot databases, such as the allowed database (DB) and the disallowed database (DBX). The DB and DBX contain certificates and signatures for authorized and unauthorized software, respectively.

Microsoft Secure Boot Certificate Expiration

Two crucial Microsoft Secure Boot certificates are set to expire in June 2026. They are:

• Microsoft Corporation KEK CA 2011 (stored in KEK)
• Microsoft UEFI CA 2011 (stored in DB)

In addition, another critical Microsoft Secure Boot certificate expires in October 2026.

• Microsoft Windows Production PCA 2011 (stored in DB)

When these certificates expire, devices may fail to recognize trusted bootloaders, and future Secure Boot policies may not be applied. Updating the certificates ensures continued protection against malicious rootkits and ensures Windows firmware compliance

View Certificate Information

Ideally, administrators could use PowerShell to view these UEFI Secure Boot certificates. Sadly, the output of the Get-SecureBootUEFI PowerShell command is not particularly helpful and does not display any pertinent certificate details.

Get-SecureBootUEFI -Name KEK

 

PowerShell Script

To address this limitation, I’ve created a PowerShell script that allows administrators to view all UEFI certificates, including PK, KEK, and DB certificates, and optionally save them as base64-encoded files. The script is available on GitHub and in the PowerShell gallery.

Install-Script -Name Get-UEFICertificate -Scope CurrentUser

View UEFI Certificates

After downloading the Get-UEFICertificate PowerShell script, run the following command to view the KEK database.

Get-UEFICertificate -Type KEK

In this example, the only KEK certificate is the expiring Microsoft Corporation KEK CA 2011 certificate. Running the command and specifying the DB type shows only the expiring Microsoft Windows Product PCA 2011 certificate.

Note: UEFI also includes hashes of specific executables in the DB and DBX databases. By default, this script focuses on UEFI certificates and omits hash calculations for brevity. Use the -IncludeHashes switch to view this information. 

Updating Microsoft UEFI Certificates

With the October 2025 updates, Microsoft introduced new registry keys to enable and monitor the update status of these UEFI Secure Boot certificates.

Status

To begin, administrators can check the status of the update process by reading the value of the UEFICA2023Status registry key.

Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing\ -Name UEFICA2023Status | Select-Object UEFICA2023Status

Update

To initiate the update process, set the value of AvailableUpdates to 0x5944.

Set-ItemProperty -Path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot’ -Name ‘AvailableUpdates’ -Value 0x5944

Next, start the Secure-Boot-Update scheduled task.

Start-ScheduledTask -TaskName ‘\Microsoft\Windows\PI\Secure-Boot-Update’

Once complete, the UEFICA2023Status indicates InProgress.

After a reboot, start the Secure-Boot-Update scheduled task once more. The UEFICA2023Status should indicate that it has been updated (may require one more reboot!).

Updated Certificates

After the update process completes, run the Get-UEFICertificate PowerShell script to confirm that new certificates have been added to UEFI Secure Boot.

Summary

With multiple Microsoft Secure Boot CA certificates expiring in 2026, organizations need to ensure devices are updated to maintain a valid UEFI trust chain. This guide shows how to view existing firmware certificates, apply Microsoft’s Secure Boot CA 2023 updates, and confirm that new KEK and DB certificates have been installed. Completing this process now will ensure devices remain protected from tampered or malicious boot components as the 2026 expiration dates approach.

Additional Information

Windows Secure Boot certificate expiration and CA updates

Registry key updates for Secure Boot: Windows devices with IT-managed updates

Get-UEFICertificate PowerShell Script on GitHub

Get-UEFICertificate PowerShell Script in the PowerShell Gallery

 

Intel 13th Gen CPUs can be tested for degradation

Intel 13th Gen CPU Instability and Degradation Test Checklist

Use this checklist to identify common instability symptoms reported on affected Raptor Lake desktop CPUs, especially K-series models. A failed test or repeated error can indicate a problem, but no single result confirms processor degradation on its own.

Before You Start

Testing can place the processor under sustained heavy load. Save important work, back up critical data, close unnecessary applications, and monitor temperatures throughout each stress test. Stop a test if temperatures exceed the safe operating range for your processor or if the system becomes unstable.

✅ Update to the latest motherboard BIOS containing Intel's microcode fixes. Intel has stated that microcode updates address the voltage-related instability issue affecting certain 13th and 14th Gen desktop processors. [community.intel.com],

Reset the BIOS to stock settings and disable XMP for the initial test sequence. If the system is stable at stock settings, repeat the relevant tests with XMP enabled to determine whether the memory profile contributes to the instability.

✅ Download:

·         Intel® Processor Diagnostic Tool [intel.com],

·         HWiNFO64

·         Cinebench R23 or Cinebench 2024

·         Prime95

 

Before testing, record the CPU model, motherboard model, BIOS version, microcode version, memory configuration, cooling setup, Windows version, and whether XMP is enabled. Use the same configuration for every test so that the results can be compared consistently.

Step 1: Run Intel Processor Diagnostic Tool

Procedure

1.      Launch Intel® Processor Diagnostic Tool.

2.      Allow all tests to complete (typically 3-5 minutes).

3.      Save a screenshot of the results.

Pass Criteria

·         All tests show PASS.

Fail Criteria

·         Any FAIL result.

·         Save screenshots for potential warranty claims. Intel's warranty extension covers eligible processors for up to five years. [community.intel.com],

 

Step 2: Check Idle Behavior

Open HWiNFO sensors and let Windows sit idle for 10 minutes.

Record

·         CPU Package Temperature

·         Vcore/VID

·         Effective Clock

·         WHEA error count

Healthy System

·         Stable temperatures

·         No WHEA errors

·         No unexplained spikes to 100% CPU

Warning Signs

·         WHEA errors occurring at idle

·         Random system freezes

·         Clock-speed fluctuations accompanied by errors

 

Step 3: Single-Core Voltage Test

The Raptor Lake issue is often most visible during lightly threaded loads because boost frequencies and voltage can be highest there.

Procedure

1.      Open HWiNFO.

2.      Run Cinebench Single Core.

3.      Monitor:

o   Maximum Core VID

o   Vcore

o   Temperature

Record

·         Peak voltage

·         Peak temperature

·         Cinebench score

Warning Signs

·         Frequent voltage excursions above ~1.5 V.

·         Excessively high temperatures despite adequate cooling.

 

Step 4: Multi-Core Cinebench Test

Procedure

1.      Run Cinebench Multi-Core.

2.      Complete 3 consecutive runs.

Check For

·         Crashes

·         Application errors

·         Score variation between runs

Healthy System

·         Scores remain consistent (within a few percent).

Suspect System

·         Scores continually decrease.

·         Cinebench crashes or hangs.

 

Step 5: Prime95 Stability Test

Procedure

1.      Launch Prime95.

2.      Select Small FFTs.

3.      Run for at least 1 hour.

Monitor

·         CPU Package Temperature

·         Clock speeds

·         WHEA errors

Healthy System

·         No worker failures.

·         No BSODs.

·         No system freezes.

Degradation Indicators

·         Worker thread errors.

·         BSODs.

·         Reboots.

·         Application crashes.

 

Step 6: WHEA Error Check

After testing:

1.      Open Event Viewer.

2.      Navigate to:

1     Windows Logs 2      └── System

Search for:

1     WHEA-Logger

Healthy

·         Zero hardware errors.

Concern

·         Repeated WHEA 18 or cache hierarchy errors.

 

Step 7: Real-World Gaming Test

Run a demanding game for 1-2 hours.

Examples:

·         Unreal Engine 5 titles

·         Shader compilation-heavy games

Watch for:

·         Crash to desktop

·         Graphics-driver recovery

·         Stutters

·         System reboots

 

Step 8: Compare Performance

Compare your results against typical scores for your CPU model.

For example:

CPU	Approx. Cinebench R23 Multi
i5-13600K	~24,000
i7-13700K	~30,000
i9-13900K	~38,000-40,000

A significantly lower score (10%+ below expected) while temperatures are normal could indicate a problem.

 

Final Assessment

Likely Healthy

✅ IPDT Pass
✅ No WHEA errors
✅ Prime95 stable for 1+ hour
✅ Cinebench scores normal
✅ No crashes in games

Potentially Degraded

⚠️ IPDT failures
⚠️ Frequent WHEA errors
⚠️ Prime95 worker failures
⚠️ Random application crashes at stock settings
⚠️ Instability persists after BIOS update
⚠️ Requires increased voltage or reduced clocks to remain stable

10 checks to make your website visible to ChatGPT, Perplexity and Claude

 More and more people skip Google and ask ChatGPT, Perplexity, Claude or Gemini "what's the best tool for X?". AI gives 3 to 5 names. If it can't read your site, it fills those spots with your competitors.

I spent the last months digging into why AI names some products and not others. Most of the reasons are boring, fixable things on your own website. Here's the checklist, with a quick way to test each one.

Part 1: Can AI read you?

1. Let AI crawlers in. Open yoursite.com/robots.txt. Make sure you don't block GPTBot, OAI-SearchBot, ChatGPT-User, PerplexityBot or ClaudeBot. Then check your CDN: Cloudflare has a setting that blocks AI bots, and some plans turn it on by default.

2. Serve real HTML. Test: open your homepage with JavaScript turned off (or curl yoursite.com). If the page is empty or says "loading", most AI crawlers see the same thing. They usually don't run JavaScript. Use server-side rendering or static pages for anything important.

3. Be in Bing, not just Google. Some AI search tools lean on Bing's index. Add your site to Bing Webmaster Tools and submit your sitemap. Takes 5 minutes.

Part 2: Does AI understand you?

4. Say what you are in one line. "X is a [category] for [who]." On your homepage, in plain text, near the top. Clever taglines like "Work, reimagined" tell AI nothing.

5. Show pricing as text. Not an image, not "contact sales" only. "Cheap" and "free tier" questions are common, and AI can't answer them about you if it can't read your price.

6. Add structured data. Organization, SoftwareApplication (or Product) and FAQ schema. Test with Google's Rich Results Test.

7. Answer the questions your customers ask AI. Write the pages people search for: "X vs Y", "best tools for [job]", "alternatives to [big competitor]". Be honest in them; AI quotes pages that read like real comparisons, not ads.

Part 3: Does AI trust you?

8. Keep your facts the same everywhere. Your site, G2, Capterra, LinkedIn, Crunchbase, Product Hunt. Same name, same category, same price. If they disagree, AI gets unsure and picks someone else.

9. Get on the lists AI cites. Ask Perplexity a question in your category and look at the sources. They're mostly "Top 10 tools for…" articles. Those are your targets: email the authors and ask to be added. Short, polite, with one real reason you fit.

10. Ask AI about yourself every week. Write down 10 to 20 questions your customers would ask. Ask them in ChatGPT, Perplexity, Claude and Gemini every week. Track who gets named. It changes more often than you'd think.

Quick 1-minute test: ask ChatGPT "What does yoursite.com do?". If the answer is vague or wrong, start with points 1, 2 and 4.

Which of these have you already done? Curious what's worked for others, especially on getting into those "best tools" lists.