To see whether your PC has the updated certificates

To see whether your PC has the updated certificates

 

To see whether your PC has the updated certificates, open a PowerShell window using administrator credentials and then run the following command:"

 

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')

 

If the response is True, you're up to date. If the response is False, you need a firmware update. 

 

"Another crucial Windows expiration date is right around the corner for more than a billion PCs. Here's what you need to do now. Last year's end-of-support deadline for Windows 10 was a big test for consumers and IT pros alike. The good news is everyone passed! The bad news is there's another crucial expiration date right around the corner. Every Windows PC designed and built since 2011 supports a feature called Secure Boot. This feature, which is on by default on new PCs sold with Windows 10 and Windows 11, acts as a gatekeeper that allows only trusted software to run at startup. If someone tries to tamper with the operating system or boot from an alternate device, Secure Boot blocks that attempt. All currently supported versions of Windows support Secure Boot, as do an increasing number of Linux distributions, including Ubuntu, Fedora, Linux Mint, OpenSUSE, and a host of others.

 

If you bought a PC in the last 15 years, it almost certainly contains Microsoft-issued KEK and UEFI CA certificates from 2011, which are slated to expire in June 2026. To update those certificates, you need access to the root of trust -- the Platform Key, which is managed by the hardware OEM.

 

If your PC was designed and built by a major OEM (Lenovo, HP, Dell, ASUS, Surface), and you are running a supported Windows version, you should receive the necessary update automatically.

 

According to Microsoft, "For most individuals and businesses that allow Microsoft to manage PC updates, the new certificates will be installed automatically through the regular monthly Windows update process, with no additional action required."

 

Those updates will arrive on almost all PCs running Windows 11 and on PCs running Windows 10 with an Extended Security Updates subscription. You might need a separate firmware update from the PC maker to allow the updated certificates to install.

 

Microsoft says it will be delivering messages about the certificate update status in the Windows Security app.

 

For specialized computers, such as servers and IoT devices, you might need to download and install an update from the device maker.

 

What happens if I don't update those certificates?

According to Microsoft, "When the 2011 CAs expire, Windows devices that do not have new 2023 certificates can no longer receive security fixes for pre-boot components, compromising Windows boot security.... Without updates, the Secure Boot-enabled Windows devices risk not receiving security updates or trusting new boot loaders, which will compromise both serviceability and security."

 

https://support.microsoft.com/en-us/topic/windows-secure-boot-certificate-expiration-and-ca-updates-7ff40d33-95dc-4c3c-8725-a9b95457578e

Windows Secure Boot certificate expiration and CA updates1.docx

Windows Secure Boot certificate expiration and CA updates

The impact of Secure Boot certificate expiration

 

Microsoft is updating the Secure Boot certificates originally issued in 2011 to ensure Windows devices continue to verify trusted boot software. These older certificates begin expiring in June 2026. Devices that haven’t received the newer 2023 certificates will continue to start and operate normally, and standard Windows updates will continue to install. However, these devices will no longer be able to receive new security protections for the early boot process, including updates to Windows Boot Manager, Secure Boot databases, revocation lists, or mitigations for newly discovered boot level vulnerabilities.

Over time, this limits the device’s protection against emerging threats and may affect scenarios that rely on Secure Boot trust, such as BitLocker hardening or third-party bootloaders. Most Windows devices will receive the updated certificates automatically, and many OEMs provide firmware updates when needed. Keeping your device current with these updates helps ensures it can continue receiving the full set of security protections that Secure Boot is designed to provide.

Windows Secure Boot certificate expiration and CA updates

---

Windows Secure Boot certificate expiration and CA updates

What is Secure Boot?

Secure Boot is a security feature in Unified Extensible Firmware Interface (UEFI) based firmware that helps ensure that only trusted software runs during a device's boot (start) sequence. It works by verifying the digital signature of pre-boot software against a set of trusted digital certificates (also known as certificate authority or CA) stored in the device's firmware. As an industry standard, UEFI Secure Boot defines how platform firmware manages the certificates, authenticates firmware, and how the operating system (OS) interfaces with this process. For more details on UEFI and Secure Boot, please see Secure boot.

Secure Boot was first introduced in Windows 8 to protect against the emerging pre-boot malware (also known as a bootkit) threat at that time. As part of platform initialization, Secure Boot authenticates firmware modules before execution. These modules include UEFI firmware drivers (such as Option ROMs), boot loaders, and applications. As the final step of the Secure Boot process, the firmware verifies if Secure Boot trusts the boot loader. Then, the firmware passes control to the boot loader, which in turn verifies, loads into memory, and starts the Windows OS.

Secure Boot defines trusted code through a firmware policy set during manufacturing. Changes to this policy, such as adding or revoking certificates, are controlled by a hierarchy of keys. This hierarchy starts with the Platform Key (PK), typically owned by the hardware manufacturer, followed by the Key Enrollment Key (KEK) (also known as Key Exchange Key), which may include a Microsoft KEK and other OEM KEKs. The Allowed Signature Database (DB) and the Disallowed Signature Database (DBX) determine which code can run in the UEFI environment before the OS starts. The DB includes certificates managed by Microsoft and the OEM, while the DBX is updated by Microsoft with the latest revocations. Any entity with a KEK can update the DB and DBX.

 

Windows Secure Boot UEFI Certificates Expiring June 2026

Windows Secure Boot UEFI Certificates Expiring June 2026

Introduction

For IT administrators responsible for managing Windows devices, a crucial certificate update milestone is coming in June 2026 that could result in degraded security for systems that are not updated. Specifically, the Microsoft certificates that manage UEFI Secure Boot trust will expire, potentially allowing untrusted or malicious software to load on affected machines during system boot.

Secure Boot

Windows Secure Boot is a UEFI firmware security feature that ensures a computer boot only with trusted, digitally signed operating system loaders and drivers, preventing malicious code (such as rootkits or compromised bootloaders) from loading during startup. Introduced with Windows 8, it verifies the cryptographic signatures of boot components against a database of authorized keys, blocking unauthorized or tampered software to protect system integrity from the earliest stages of boot.

Chain of Trust

The UEFI Platform Key (PK) is the ultimate root of trust in Secure Boot. It is a single public key owned by the device manufacturer and stored in firmware. The PK certificate signs the Key Exchange Key (KEK) and grants authority to modify the other Secure Boot databases, such as the allowed database (DB) and the disallowed database (DBX). The DB and DBX contain certificates and signatures for authorized and unauthorized software, respectively.

Microsoft Secure Boot Certificate Expiration

Two crucial Microsoft Secure Boot certificates are set to expire in June 2026. They are:

• Microsoft Corporation KEK CA 2011 (stored in KEK)
• Microsoft UEFI CA 2011 (stored in DB)

In addition, another critical Microsoft Secure Boot certificate expires in October 2026.

• Microsoft Windows Production PCA 2011 (stored in DB)

When these certificates expire, devices may fail to recognize trusted bootloaders, and future Secure Boot policies may not be applied. Updating the certificates ensures continued protection against malicious rootkits and ensures Windows firmware compliance

View Certificate Information

Ideally, administrators could use PowerShell to view these UEFI Secure Boot certificates. Sadly, the output of the Get-SecureBootUEFI PowerShell command is not particularly helpful and does not display any pertinent certificate details.

Get-SecureBootUEFI -Name KEK

 

PowerShell Script

To address this limitation, I’ve created a PowerShell script that allows administrators to view all UEFI certificates, including PK, KEK, and DB certificates, and optionally save them as base64-encoded files. The script is available on GitHub and in the PowerShell gallery.

Install-Script -Name Get-UEFICertificate -Scope CurrentUser

View UEFI Certificates

After downloading the Get-UEFICertificate PowerShell script, run the following command to view the KEK database.

Get-UEFICertificate -Type KEK

In this example, the only KEK certificate is the expiring Microsoft Corporation KEK CA 2011 certificate. Running the command and specifying the DB type shows only the expiring Microsoft Windows Product PCA 2011 certificate.

Note: UEFI also includes hashes of specific executables in the DB and DBX databases. By default, this script focuses on UEFI certificates and omits hash calculations for brevity. Use the -IncludeHashes switch to view this information. 

Updating Microsoft UEFI Certificates

With the October 2025 updates, Microsoft introduced new registry keys to enable and monitor the update status of these UEFI Secure Boot certificates.

Status

To begin, administrators can check the status of the update process by reading the value of the UEFICA2023Status registry key.

Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing\ -Name UEFICA2023Status | Select-Object UEFICA2023Status

Update

To initiate the update process, set the value of AvailableUpdates to 0x5944.

Set-ItemProperty -Path ‘HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot’ -Name ‘AvailableUpdates’ -Value 0x5944

Next, start the Secure-Boot-Update scheduled task.

Start-ScheduledTask -TaskName ‘\Microsoft\Windows\PI\Secure-Boot-Update’

Once complete, the UEFICA2023Status indicates InProgress.

After a reboot, start the Secure-Boot-Update scheduled task once more. The UEFICA2023Status should indicate that it has been updated (may require one more reboot!).

Updated Certificates

After the update process completes, run the Get-UEFICertificate PowerShell script to confirm that new certificates have been added to UEFI Secure Boot.

Summary

With multiple Microsoft Secure Boot CA certificates expiring in 2026, organizations need to ensure devices are updated to maintain a valid UEFI trust chain. This guide shows how to view existing firmware certificates, apply Microsoft’s Secure Boot CA 2023 updates, and confirm that new KEK and DB certificates have been installed. Completing this process now will ensure devices remain protected from tampered or malicious boot components as the 2026 expiration dates approach.

Additional Information

Windows Secure Boot certificate expiration and CA updates

Registry key updates for Secure Boot: Windows devices with IT-managed updates

Get-UEFICertificate PowerShell Script on GitHub

Get-UEFICertificate PowerShell Script in the PowerShell Gallery

 

Intel 13th Gen CPUs can be tested for degradation

Intel 13th Gen CPU Instability and Degradation Test Checklist

Use this checklist to identify common instability symptoms reported on affected Raptor Lake desktop CPUs, especially K-series models. A failed test or repeated error can indicate a problem, but no single result confirms processor degradation on its own.

Before You Start

Testing can place the processor under sustained heavy load. Save important work, back up critical data, close unnecessary applications, and monitor temperatures throughout each stress test. Stop a test if temperatures exceed the safe operating range for your processor or if the system becomes unstable.

✅ Update to the latest motherboard BIOS containing Intel's microcode fixes. Intel has stated that microcode updates address the voltage-related instability issue affecting certain 13th and 14th Gen desktop processors. [community.intel.com],

Reset the BIOS to stock settings and disable XMP for the initial test sequence. If the system is stable at stock settings, repeat the relevant tests with XMP enabled to determine whether the memory profile contributes to the instability.

✅ Download:

·         Intel® Processor Diagnostic Tool [intel.com],

·         HWiNFO64

·         Cinebench R23 or Cinebench 2024

·         Prime95

 

Before testing, record the CPU model, motherboard model, BIOS version, microcode version, memory configuration, cooling setup, Windows version, and whether XMP is enabled. Use the same configuration for every test so that the results can be compared consistently.

Step 1: Run Intel Processor Diagnostic Tool

Procedure

1.      Launch Intel® Processor Diagnostic Tool.

2.      Allow all tests to complete (typically 3-5 minutes).

3.      Save a screenshot of the results.

Pass Criteria

·         All tests show PASS.

Fail Criteria

·         Any FAIL result.

·         Save screenshots for potential warranty claims. Intel's warranty extension covers eligible processors for up to five years. [community.intel.com],

 

Step 2: Check Idle Behavior

Open HWiNFO sensors and let Windows sit idle for 10 minutes.

Record

·         CPU Package Temperature

·         Vcore/VID

·         Effective Clock

·         WHEA error count

Healthy System

·         Stable temperatures

·         No WHEA errors

·         No unexplained spikes to 100% CPU

Warning Signs

·         WHEA errors occurring at idle

·         Random system freezes

·         Clock-speed fluctuations accompanied by errors

 

Step 3: Single-Core Voltage Test

The Raptor Lake issue is often most visible during lightly threaded loads because boost frequencies and voltage can be highest there.

Procedure

1.      Open HWiNFO.

2.      Run Cinebench Single Core.

3.      Monitor:

o   Maximum Core VID

o   Vcore

o   Temperature

Record

·         Peak voltage

·         Peak temperature

·         Cinebench score

Warning Signs

·         Frequent voltage excursions above ~1.5 V.

·         Excessively high temperatures despite adequate cooling.

 

Step 4: Multi-Core Cinebench Test

Procedure

1.      Run Cinebench Multi-Core.

2.      Complete 3 consecutive runs.

Check For

·         Crashes

·         Application errors

·         Score variation between runs

Healthy System

·         Scores remain consistent (within a few percent).

Suspect System

·         Scores continually decrease.

·         Cinebench crashes or hangs.

 

Step 5: Prime95 Stability Test

Procedure

1.      Launch Prime95.

2.      Select Small FFTs.

3.      Run for at least 1 hour.

Monitor

·         CPU Package Temperature

·         Clock speeds

·         WHEA errors

Healthy System

·         No worker failures.

·         No BSODs.

·         No system freezes.

Degradation Indicators

·         Worker thread errors.

·         BSODs.

·         Reboots.

·         Application crashes.

 

Step 6: WHEA Error Check

After testing:

1.      Open Event Viewer.

2.      Navigate to:

1     Windows Logs 2      └── System

Search for:

1     WHEA-Logger

Healthy

·         Zero hardware errors.

Concern

·         Repeated WHEA 18 or cache hierarchy errors.

 

Step 7: Real-World Gaming Test

Run a demanding game for 1-2 hours.

Examples:

·         Unreal Engine 5 titles

·         Shader compilation-heavy games

Watch for:

·         Crash to desktop

·         Graphics-driver recovery

·         Stutters

·         System reboots

 

Step 8: Compare Performance

Compare your results against typical scores for your CPU model.

For example:

CPU	Approx. Cinebench R23 Multi
i5-13600K	~24,000
i7-13700K	~30,000
i9-13900K	~38,000-40,000

A significantly lower score (10%+ below expected) while temperatures are normal could indicate a problem.

 

Final Assessment

Likely Healthy

✅ IPDT Pass
✅ No WHEA errors
✅ Prime95 stable for 1+ hour
✅ Cinebench scores normal
✅ No crashes in games

Potentially Degraded

⚠️ IPDT failures
⚠️ Frequent WHEA errors
⚠️ Prime95 worker failures
⚠️ Random application crashes at stock settings
⚠️ Instability persists after BIOS update
⚠️ Requires increased voltage or reduced clocks to remain stable