This post is for Windows 11 owners who have read that the old Secure Boot certificates expire on 19 October 2026 and who cannot see any sign of the replacement on their own PC. By the end you will know the order in which to check things, which steps are safe, which are not, and when a missing update is simply a matter of waiting. It needs no tools and no opening of the laptop.
Why has the Secure Boot certificate update not reached my PC?
Short answer: Microsoft sends the newer 2023 certificates through Windows Update, and updates reach different PCs at different times. Older Windows builds, paused updates, a missing laptop-maker BIOS update or a blocked update service may delay it. First confirm that Secure Boot is on, then run Windows Update fully, then look at your laptop maker's support page. Do not force anything.
Where does 19 October come from?
Secure Boot (a start-up safety check that lets only trusted software load before Windows) uses digital certificates, which are like ID cards with an expiry date. Microsoft is replacing its 2011 set with a 2023 set. The dates are below, and Microsoft describes the rollout in its support article on Secure Boot certificate updates.
We are not predicting what an expired certificate does to a particular PC, so treat this as a checklist, not an alarm.
The checks, in order
1. Is Secure Boot on?
Press the Windows key and R, type msinfo32 and press Enter. Look at Secure Boot State. It should say On. If it says Off or Unsupported, change nothing yet; note it down and read the help section below.
2. Is Windows fully up to date?
Open Settings, Windows Update and choose Check for updates. Install everything, restart, and check again until it says you are up to date. Also look at Advanced options for any updates marked optional. The wording can differ slightly between versions.
3. Is updating paused or blocked?
On the same Windows Update page, check that Pause updates is not switched on. Office and college laptops are often managed by an IT team, who then decide when new certificates arrive. In that case ask them rather than changing anything yourself.
4. Does your laptop maker have a BIOS update?
BIOS (the small program that starts the laptop before Windows loads) updates can matter for Secure Boot. Open your laptop maker's support page, enter the model name and look for a BIOS update. Our guide to updating a laptop BIOS safely walks through the steps. Do not switch the laptop off while a BIOS update is running.
5. Check the certificate itself
Right-click Start and open Terminal (Admin). Paste the line below and press Enter. It only reads information.
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
True means the 2023 certificate is already present. False means it has not arrived. An error can mean Secure Boot is off.
What to leave alone
- Do not turn Secure Boot off. It removes a protection and changing it can bring up a BitLocker recovery screen.
- Do not run scripts, registry edits or fixer tools sent through messages or videos. A wrong change can leave the PC unable to start.
- Do not upgrade or reinstall Windows only because a certificate has not arrived.
Save your BitLocker key now
Microsoft lists a BitLocker recovery prompt as a known case on some PCs when the new certificates arrive. BitLocker is Windows' built-in drive lock, and the prompt asks for a 48-digit key. Check Settings, Privacy and security, Device encryption, and confirm the key is saved to your Microsoft account. Write it on paper too. If a prompt has already appeared, read our BitLocker drive recovery guide.
Patchy broadband, power cuts and older laptops
Patchy broadband is a frequent reason updates stall. Let large downloads finish on a steady connection rather than a weak mobile hotspot, and do not close the lid mid-update. Voltage dips and power cuts are the risk for firmware: keep the charger plugged in, and put a desktop on a UPS (a small battery backup). Many laptops here are older models, so the maker's BIOS page may carry no new update; in that case wait for Windows Update rather than hunting for files on unofficial sites.
When to get help
- Secure Boot shows Off on a laptop where you never changed it.
- Windows Update fails again and again with the same error.
- The laptop restarts repeatedly or shows a BitLocker screen and you lack the key.
- A BIOS update was cut off by a power failure.
Our BIOS repair and update service covers these. In Hyderabad we can visit you through our doorstep service. The charge is ₹149 doorstep visit fee, waived when you approve laptop repair with us. We also accept laptops by courier from anywhere in India.
A note from the LRW Engineer Team
A missing update is not an emergency, and a forced fix can become one. If the checks look normal, leave the laptop updating on its charger and look again after a few days. Spend the saved effort on something that really protects you: a written BitLocker key and a recent backup of your important files.