The last of the old Secure Boot certificates expires on Monday

Monday is the date. On 19 October the Microsoft Windows Production PCA 2011 certificate expires. That is the one that signs the Windows boot manager, the small piece of code that runs before Windows does and that Secure Boot inspects every time your PC starts. We covered this changeover back in July, after the first two 2011 certificates lapsed in June. This is the last of them.

Nothing dramatic happens on Monday morning. Microsoft's guidance says affected PCs will still start and operate normally, and they keep getting ordinary Windows updates. What they lose is quieter: no more updates to the Windows Boot Manager, no new entries in the Secure Boot revocation lists, and no fixes for boot-level flaws discovered from here on. That is the layer meant to stop something like the BlackLotus bootkit, malware that loads before Windows and therefore before any security software has woken up. Your PC does not break. It just stops getting one particular kind of repair.

Checking takes under a minute. Open Windows Security, go to Device security, then Secure Boot. "All required certificate updates have been applied" means you are finished. "Older boot trust configuration" means you have pending updates to install and a restart to do. "Hardware or firmware limitations" points at your PC maker, so look for a BIOS update on their support page. And if it says Microsoft has paused the update because of a known issue on your model, leave it be; that pause is deliberate. Every version of Windows 11 is in scope, and Windows 10 only if you are enrolled in Extended Security Updates.

Tendvane's security-posture check reads the same Secure Boot and BitLocker state that Windows Security does, so you can see where your PC stands without going looking for the menu.