Most IT deadlines come with a little drama. This one is so quiet that a lot of organizations may miss it entirely.
Starting next week, the Microsoft certificates that have anchored Secure Boot on Windows PCs and servers since 2011 begin to expire. Secure Boot is the feature that checks, every time a computer starts, that only trusted software loads before Windows does. It's a key defense against bootkits and rootkits, malware that hides below the operating system where antivirus tools have a hard time seeing it.
Here are the dates, as published by Microsoft and Dell:
- Microsoft Corporation KEK CA 2011 expires June 24, 2026.
- Microsoft Corporation UEFI CA 2011 expires June 27, 2026.
- Microsoft Windows Production PCA 2011 expires October 19, 2026.
Replacement certificates issued in 2023 are already rolling out, and they're valid until 2038.
What actually happens on June 24
Let's clear up the biggest misconception first. Your computers will not stop booting. Dell's guidance is explicit that systems will still be able to start after the certificates expire.
The problem is subtler. A device that doesn't get the 2023 certificates can no longer receive future Secure Boot and boot manager security updates. If Microsoft needs to block a newly discovered bootkit or patch the boot process, those devices are left out. They'll look fine and run fine, while missing protections that newer or updated machines get.
That's the kind of gap attackers like, because nobody notices it until it matters.
Most devices will update themselves. Some won't.
For most supported, recent hardware, the fix arrives through Windows Update with no extra work. The University of Wisconsin's IT team summed it up for its own users: most devices will update automatically, but some older systems need a firmware update from the manufacturer first.
That's where it gets more involved.
Dell says it will deliver BIOS updates for consumer and commercial platforms with an end of service life after December 31, 2025. For older platforms that reached end of service life before 2026, Dell doesn't plan updates, and their BIOS may not support or keep the new certificates.
There's one more catch worth knowing. Dell warns that disabling or toggling Secure Boot, or resetting BIOS to defaults, can wipe the stored certificate data. On machines with BitLocker, that can also trigger a request for the recovery key. If your technicians routinely toggle BIOS settings during troubleshooting, they need to know about this.
Windows 10 machines aren't left out entirely. According to Dell, they can receive the new certificates if they're enrolled in Microsoft's Extended Security Updates program or running Windows 10 LTSC 2021.
Why this matters for schools and local government
Public agencies tend to keep hardware longer than most businesses. A computer lab bought with grant money in 2018, a server running a county's records system or a dispatch workstation nobody wants to touch could easily fall into the group that needs manual attention, or that won't get a firmware update at all.
Servers deserve their own look. Dell has published separate BIOS guidance for PowerEdge servers covering the certificate change. If you have older servers running critical services, check them specifically rather than assuming Windows Update will handle it.
A short checklist for the next few weeks
Confirm Secure Boot is on. This change only affects devices that use UEFI with Secure Boot enabled. Machines with it turned off have a bigger problem than certificates. Where hardware supports it, Secure Boot should be enabled.
Find your oldest hardware. Pull a list of devices by model and age from your management tools. Check each model against the manufacturer's support list. For Dell devices, that means comparing end-of-service-life dates against Dell's published platform list.
Update BIOS where needed. For supported models that need it, schedule firmware updates. Test on a few machines first, especially ones with BitLocker, and have recovery keys on hand.
Check servers separately. Review vendor guidance for each server platform and plan updates during a maintenance window.
Decide what to retire. Hardware that won't receive the new certificates is a strong candidate for replacement. Pair this with your Windows 11 planning, since the overlap between the two lists is likely to be large.
Don't toggle Secure Boot casually. Make sure technicians know the risks of turning it off and on or resetting BIOS defaults on affected machines.
Where vTECH io fits
As a Dell Technologies Platinum Partner, vTECH io helps Florida school districts, municipalities and county agencies inventory their devices, apply BIOS and firmware updates at scale and plan replacements for hardware that has reached end of life. If you're not sure how many of your PCs and servers are ready for this change, we can help you find out. Call us at 888-277-5918.
Sources
- Secure Boot transition FAQ, Dell Technologies
- PowerEdge: Server BIOS update guidelines for Microsoft Secure Boot certificates, Dell Technologies
- Windows Secure Boot certificate expiration and CA updates, Microsoft Support
- Microsoft Secure Boot certificate expiration 2026, University of Wisconsin-Madison KnowledgeBase