Computer Repair · November 9, 2026 · ComputerKing Team

Your Windows PC Boots Fine, but Its Boot Security May Still Be Stuck in 2011: Secure Boot 2023 Certificate Check Guide

On 19 October 2026, Microsoft's 2011 Secure Boot certificates expired, replaced by new 2023 certificates. A PC that still boots normally has not necessarily received the new certificate — without it, future boot-layer security fixes will not be delivered to your machine. This guide shows three ways to check: the sentence in Windows Security, one PowerShell command, and event 1808 in Event Viewer, plus when not to reset your BIOS to defaults.

Key points

On 19 October 2026, Microsoft's last 2011 Secure Boot certificates expired. From that day on, boot-layer security fixes are signed only with the new 2023 certificates — your PC must hold the new certificate before it can receive those fixes. The easy mistake is to assume nothing is wrong: a PC without the new certificate still boots perfectly, with no warning at all. There are three ways to find out where you stand: read the sentence in Windows Security, ask the firmware directly with one PowerShell command, and look for event 1808 in Event Viewer as proof. This guide walks through each one, plus when to update your BIOS and when not to touch the BIOS reset.

1. What happened: the 2011 certificates expired, the 2023 ones are the future

• What Secure Boot does: at startup it checks that boot software is signed and trusted, stopping unauthorised code from running before Windows loads. Certificates are the credentials used to verify those signatures.
• The 2011 certificates expired on 19 October 2026. Microsoft issued replacement certificates back in 2023 and has been delivering them through Windows Update to eligible PCs.
• The point is not whether your PC breaks on expiry day — it does not. The point is that later boot manager fixes are signed only with the 2023 certificate. A PC without it cannot install those fixes.
• One more thing to know: new Windows install media boots with a 2023-signed boot manager by default. On firmware without the new certificate it will fail with a Secure Boot violation. Microsoft has also said future major Windows releases may require the certificate to install.

2. Why booting fine does not mean everything is fine

• An expired certificate does not stop your PC from booting, and it shows no warning. The old boot manager simply stays frozen in place — so if a boot-layer flaw is found later, the fix Microsoft ships cannot be installed on your PC without the new certificate.
• Blocking known-bad boot software is also gated on the 2023 certificate. Until it is installed, that step does not happen, and your boot defences stay at the old state.
• Different PCs in the same home can give different answers. A reporter who tested four machines on 6 November 2026 found a 2023 laptop fully done, a 2018 desktop that had the certificate but had not finished switching over, a Windows 10 machine with nothing at all, and another with no Secure Boot card in Windows Security. Check each PC on its own — do not guess.

3. Three checks, from easiest to most conclusive

Step 1: Windows Security — read the sentence, not just the colour

1. Open Windows Security, go to Device security, and look at the Secure Boot card.

2. Since April 2026 this card reports certificate status. Under a green tick there should be a sentence saying Secure Boot is on with all required certificate updates applied.

3. A yellow tick with a sentence about an older boot trust configuration means the OS has not finished the certificate update — install updates and restart.

4. Colour alone is not reliable. The badge resets to green once a warning is dismissed, and on employer-managed PCs these changes are hidden by default.

5. If there is no Secure Boot card at all, that does not mean all is well — check Secure Boot State in System Information. If it says Off, this PC will not receive the new certificates.

Step 2: One PowerShell command — ask the firmware directly

1. Open PowerShell as an administrator.

2. Paste this command:

```

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

```

3. True means the 2023 Windows certificate is in your firmware; False means it is not there yet.

4. This asks the firmware directly, so it is more reliable than the badge.

Step 3: Event Viewer, event 1808 — the receipt

1. Open Event Viewer, go to Windows Logs, then System, and filter for event ID 1808.

2. This event is recorded only after the required certificates have been applied and the new boot manager is in place. It is the receipt that the switch is complete.

3. If PowerShell says True but there is no 1808 event, you are only halfway there: the certificate is in the firmware, but Windows has not switched to the new boot manager yet.

4. If you see errors such as 1795 or 1802, the update is stuck or blocked, usually by firmware.

4. Four results, four responses

5. If the new certificate has not arrived, do it in this order

1. Save your BitLocker recovery key first and confirm it is stored in your Microsoft account. Before touching boot settings, this step cannot be skipped — if the system asks for the recovery key and you do not have it, you are in serious trouble.

2. Install all pending Windows updates, then restart — possibly twice.

3. Check the PC maker's website for a BIOS update and install it following the official instructions.

4. Run the PowerShell command again to verify. The 2018 desktop mentioned above was fixed exactly this way: pending updates plus two restarts.

5. Windows 10 users, take note: Windows 10 PCs not enrolled in extended updates will not receive the new certificate. Enrolled PCs keep receiving updates until October 2027.

6. If the maker no longer issues BIOS updates, this PC may never get the new certificate. It will keep working, but treat it as a lower-trust machine and do not keep important data only on it.

6. Do not do this: resetting the BIOS to defaults

• The BIOS holds two lists: the active list that Windows updates, and the factory defaults stored in firmware.
• If your PC has already moved to the 2023 boot manager but the factory defaults lack the 2023 certificate, pressing reset to defaults makes Secure Boot refuse to boot, because the new boot manager no longer matches the old certificate.
• Fixing that needs a recovery USB that writes the certificate back — not something most people can do at home.
• So if the PC maker has not updated its factory defaults, do not press the BIOS reset. If you suspect a BIOS problem, back up first and ask before changing anything.

7. When to bring it in

• You have done the steps above twice and PowerShell still says False, or the event log shows 1795 or 1802 errors.
• You are not sure whether BitLocker is on, or where the recovery key is.
• The PC is a work machine, or has special boot settings such as dual boot or Linux alongside Windows.
• In these cases, bring the machine in with your check results, rather than changing firmware settings on your own when you are unsure.