Most PCs will keep booting after the expiration, but if your device's firmware doesn't receive the new 2023 certificates before the old 2011 certificate expires, it may enter a degraded security state and stop receiving some Secure Boot–related updates. Check updates and firmware status to be safe.
Here’s how to update your BIOS safely
You'll need to check if your PC needs the latest updates.
Secure Boot verifies the identity of everything trying to load before Windows appears. Windows has trusted a group of security certificates issued as far back as 2011, and Microsoft is now gradually phasing them out in favour of a new set from 2023. Two of the certificates expired in June, and today is the end of the last major one: the Windows Production PCA 2011.
To find your BIOS update, go to your PC manufacturer's website and look up your exact model number (it's usually in your system settings). Save all open files, and if you can, keep your laptop connected to the power supply. Firstly, back up your BitLocker recovery key before making any changes, since certain manufacturer BIOS updates may inadvertently cause a recovery loop.
Download the latest BIOS update for your device and follow the instructions on the support page—most companies provide step-by-step guides or even update tools you can use directly from within Windows.
Most personal computers receive updates automatically via Windows Update, slowly and gradually. However, if you're using older hardware, check your system now to ensure your digital security guard has updated ID badges.
You don't need complicated command prompts to check your current status, since Windows 11 has a built-in status check in your security settings; open Windows Security, go to Device security, and click Secure Boot to view the status message.
As long as all necessary certificate updates are complete and show a green tick, you're all set and don't need to do anything. If it reads 'older boot trust configuration' or shows yellow warnings, your computer likely just needs an update, so look for any pending Windows updates, install them, and then restart your PC. However, if you see a red stop sign that says 'requires action' or a warning that it can no longer receive required updates, your system has expired certificates, and you'll need to update it to stay secure!
Auto 
2 weeks ago
2 
