Secure Boot Certificate: 3-Step PC Check

Windows Security shows a green tick beside Secure Boot, yet every headline says a certificate ran out. Both can be true, and that gap is the whole problem. Microsoft's Windows Production PCA 2011 expired on 19 October 2026, and the secure boot certificate that replaces it may or may not be on your PC. You can find out in about a minute, in three places, checked in order.

How do I check if my PC has the Secure Boot certificate update?

Run three checks in order and stop at the first clear answer: the exact wording in Windows Security, Event 1808 or 1801 in Event Viewer, then one registry value read in PowerShell.

1. Windows Security. Open Device security, then Secure Boot, and read the sentence under the badge. On Microsoft's status page, "all required certificate updates have been applied" means no action, while "older boot trust configuration" means install updates and restart.
2. Event Viewer. In the System log, filter for source TPM-WMI. Event 1808, "This device has updated Secure Boot CA/keys," is the all-clear. Event 1801 means certificates updated but not yet applied to firmware, per Microsoft's events list.
3. PowerShell. In an administrator window, run Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing | Select-Object UEFICA2023Status, UEFICA2023Error. Microsoft's registry page treats Updated with an error of 0 as finished; NotStarted or InProgress means not yet.

That is the one-minute check to run on your own PC tonight, and step one alone is not enough. Malwarebytes wrote on 28 May 2026 that a green checkmark alone does not confirm the new certificates were applied. An asker on Microsoft's Q&A site wanted to know how to confirm the fix had worked, which says plenty about the signal, or maybe just how many people share the question.

Will my PC still boot now the 2011 certificates have expired?

Yes: Microsoft says devices without the 2023 certificates continue to start and operate normally, and ordinary Windows updates still install, so an expired date alone does not lock you out.

What stops is the early-boot side. Microsoft states that such a PC can no longer receive new Boot Manager updates, Secure Boot database and revocation-list updates, or fixes for newly found boot-level flaws. Our reading: maintenance, not emergency, but with no natural reminder, so it gets skipped. The fix arrives through Windows Update, so confirm your build with the Windows 11 24H2 winver check, and if updates keep failing, start with the September Windows 11 update problems.

Worked example: a Windows 11 PC with Secure Boot on has never logged Event 1808, and still holds its factory 2011 certificates. Today is 25 October 2026. The key-exchange certificate expired on 24 June 2026, so 24 June to 24 October is 30 + 31 + 31 + 30 = 122 days, plus one to reach today: 123 days. That PC has booted through 123 days of an expired certificate without failing, so expiry alone is not the risk; the missing 2023 certificates are.

Four numbers frame the urgency, and the retry schedule comes from Microsoft's troubleshooting guide.

The retry cadence makes patience a fair first move: a PC showing Event 1801 may simply be mid-way.

What does each result mean, and what should I do?

Find your row and read across: 1808 means finished, 1801 means restart and recheck, errors 1795 and 1796 point at the firmware, and 1032 means pause BitLocker first.

Only the error rows need a human: Microsoft says to contact the device maker for 1795, and 1032 sits with your BitLocker setup.

Does the Secure Boot update trigger BitLocker recovery?

It can: Microsoft logs Event 1032 when your BitLocker setup would trigger recovery mode if the update were applied, and its fix is to suspend BitLocker for two restarts, then turn it back on.

Microsoft also notes a device may ask for the recovery key once after the update; enter it and check for firmware updates. Windows Latest reported on 26 May 2026 that HP had acknowledged a BIOS update leaving some commercial PCs in a BitLocker recovery loop, with the 2023 certificates failing to install meanwhile. Our call: treat every firmware update on a BitLocker PC as a recovery-key moment, and store the key somewhere that is not that PC.

One poster on Microsoft's Q&A forum described a status stuck at InProgress with events 1796 and 1801 repeating, an update that keeps retrying and never lands.

• Secure Boot off. A PC in legacy BIOS or CSM mode, Malwarebytes reports, sits outside this update.
• Reset to defaults. Microsoft says avoid it unless the maker's defaults include the 2023 certificates.
• Dismissed warnings. Dismiss installs nothing, and Microsoft calls it not recommended.
• Windows 10. Microsoft's expiry page lists Windows 10 22H2, so run the same three checks; patch timing is in the Windows 10 ESU extension to October 2027.

The decision is whether to wait for Windows or step in yourself, and for most PCs it is wait. Tonight, run the three checks. At Event 1808, close the laptop. Otherwise install updates, restart, recheck tomorrow, and touch firmware only once your recovery key is saved off the PC.