Windows Secure Boot’s 42-Day Cliff: Microsoft’s 2011 UEFI Certificates Expire 19 June 2026 — The UK SME Deployment Plan Before Next Tuesday’s Last-Comfort Patch Window

On 8 May 2026, every UK SME running a Windows estate is staring at the same calendar entry. In 42 days, on 19 June 2026, the cryptographic spine that has signed every Windows boot path on Earth for the last fifteen years — the Microsoft 2011 Secure Boot certificate chain — starts to expire. Devices will still turn on. Windows Update will still pull cumulative updates. BitLocker will not re-prompt. But from that date forward, any machine that has not been moved to the new 2023 certificate chain will be quietly locked out of every future Secure Boot security update Microsoft ships: no new Boot Manager updates, no new DBX revocations, no mitigations for boot-level vulnerabilities that surface in 2027, 2028 or beyond.

This is not a Windows 10 cliff. It is not a paid Extended Security Update. It does not need new hardware or a new licence. The 2023 chain is free, and Microsoft has been shipping it inside cumulative updates since October 2025. What it does need is engineering time, an honest inventory of every Windows endpoint and server in your estate, and a deployment plan that lands on the right side of Patch Tuesday on 12 May 2026 — according to Help Net Security’s May forecast, the last comfortable patch window before the June expiry. This is the full UK SME action plan: what is changing, what stops working, the four supported deployment paths, the PowerShell verification kit, the Cyber Essentials v3.3 Danzell angle, and a 42-day rollout sequence keyed to the 0x5944 registry value and the \Microsoft\Windows\PI\Secure-Boot-Update scheduled task.

What Microsoft has actually announced

The Microsoft IT Pro team and the wider Windows engineering organisation have, over the last seven months, published the most detailed and most accessible certificate-rotation plan in the platform’s history. The headline is straightforward: four certificates that have signed Windows Boot Managers, third-party UEFI bootloaders, Option ROMs and the DBX revocation lists since 2011 are reaching their fifteen-year design life and rolling over to a parallel set of 2023 certificates. The pivot points are calendar dates, not telemetry-triggered events, and once the dates land they will not move.

Two of the four expiring CAs — Microsoft Corporation KEK CA 2011 (the Key Exchange Key that signs DB and DBX updates pushed by Microsoft) and Microsoft UEFI CA 2011 (the third-party CA that signs Linux shims, GRUB and Option ROM signatures for network cards, RAID controllers and discrete GPUs) — expire in June 2026. The third CA, Microsoft Windows Production PCA 2011 (the cert that signs the Windows Boot Manager itself), follows on 14 October 2026. Each one is being replaced by a named 2023 successor stored in either KEK or DB on the device’s firmware: Microsoft Corporation KEK 2K CA 2023, Microsoft UEFI CA 2023, Microsoft Option ROM UEFI CA 2023, and Windows UEFI CA 2023. The Option ROM bifurcation is new — one 2011 CA is being replaced by two 2023 CAs to cleanly separate operating-system bootloader signing from peripheral firmware signing.

Microsoft began shipping the 2023 CAs as part of October 2025 cumulative updates, which is when the chain-of-trust transition started. The January 2026 cumulative updates moved the rollout from optional to phased automatic deployment for ‘high-confidence’ devices — estates whose hardware vendors and firmware versions Microsoft has verified work cleanly with the new chain. The April 2026 cumulative updates added a Secure Boot certificate status panel inside the Windows Security app, so end users and IT administrators can see, on a single screen and without PowerShell, whether a device is on the 2011 or 2023 chain. The IT pro landing page is https://aka.ms/GetSecureBoot and is the single source of truth for the rollout.

The 2025-2026 timeline at a glance

How urgent is each certificate, in days

Translating the above into a single ranked view of remaining time helps prioritise the rollout. The 19 June expiries are the binding constraint. The DBX revocation window is a Microsoft-defined cadence rather than a single date, but the published guidance places it within a few weeks of the June expiries. The 14 October Production PCA is the longest pole in the tent but it is the one that breaks future feature updates, not just future security updates.

What still works after June — and what does not

One of the most useful framings of this rollover, and the one most worth communicating to non-technical leadership in your SME, is the difference between ‘continues working’ and ‘stops getting updates’. The 2011 chain expiring does not brick devices. It does not prevent Windows from booting. It does not stop the Defender engine from updating, BitLocker from unlocking the volume, or Windows Update from pulling cumulative updates. Standard application code-signing chains are completely unaffected — this is UEFI / pre-OS code only.

What does change is the device’s ability to receive future Secure Boot updates. After June, a 2011-only device will be unable to install new Boot Manager updates Microsoft ships in subsequent cumulative updates, will not pull new DBX revocations, and once Microsoft pushes the post-June DBX revocation of UEFI CA 2011, will refuse to load third-party bootloaders signed only with the old CA. New Linux distribution releases that use a 2023-signed shim, security tools that ship their own bootloader, and any Option ROM firmware updates re-signed under the 2023 chain will all be blocked. The donut below is the cleanest visual we have for this divide.

How ready is your estate, honestly

Before you push any registry value or stage any GPO, the highest-leverage action is an honest readiness assessment. The score grid below is the one Cloudswitched uses with new IT Support clients in the first conversation. Each row is binary in spirit but expressed on a Red / Amber / Green scale because in practice an SME estate is rarely all the way to one extreme. If three or more rows score Red, the 12 May Patch Tuesday is your ‘decision’ window, not your ‘deploy’ window — meaning you spend the next four days doing inventory, not certificate updates.

What it costs in engineering time, by estate size

The licence column of the cost table for this rollover is mercifully simple: the 2023 CAs ship inside ordinary cumulative updates, so the answer is £0 across the board for every supported version. There is no Extended Security Update equivalent, no per-device fee, and no Microsoft 365 add-on required. The cost is entirely engineering time, and the curve scales with estate size and with how distributed and how heterogeneous your hardware is. A 30-endpoint single-site SME with Microsoft 365 Business Premium and Intune is a genuinely different shape of project from a 250-endpoint multi-site SME with mixed Surface, Dell and HP hardware on a slow firmware patching cadence.

Three deployment postures — and the failure mode of each

The choice you actually face is not technical. It is a posture choice between waiting and seeing, phasing the rollout before 12 May Patch Tuesday, or holding back to a single big-bang deployment in late June. Each one has a different failure mode, a different cost, and a different conversation with leadership and with your cyber insurance renewal questionnaire. The Cloudswitched recommendation, set out under the ‘Phase before 12 May’ column, is the one most likely to leave you with the smallest support load and the cleanest evidence for Cyber Essentials.

The 10-step rollout plan, in order, with dependencies

This is the sequence a managed IT Support team would run for a typical 50–200 endpoint UK SME starting today. The percentages on the progress bars represent how much of the work the average estate has typically already done by 8 May 2026 — based on Microsoft’s phased rollout signals, not a sourced UK statistic. If your numbers are materially worse than these, treat them as a calibrated warning, not a benchmark.

Cyber Essentials v3.3 Danzell exposure if you do nothing

The UK Cyber Essentials v3.3 control set, published as the Danzell update on 27 April 2026, includes A2.4 covering boot security. The control text reads, in our paraphrase, that boot processes must be ‘secure boot enabled and supported by current vendor security updates.’ A device on the 2011 chain after 19 June can still report Secure Boot as enabled in the firmware menu, but it has been cut off from current vendor security updates — specifically the new DBX revocations Microsoft will publish under the 2023 chain. That is, on our reading of the control text, an A2.4 gap. The gauge below visualises the exposure trajectory if you take no action.

The four supported deployment paths, with the exact registry values

Microsoft documents four supported paths to apply the 2023 CAs. Each one ends up writing the same registry value and triggering the same scheduled task. The choice of path is operational, not technical — pick the one that matches how you already manage Windows policy in your estate.

The PowerShell verification kit

Whichever deployment path you choose, the verification step is identical. It is also the step most often skipped — the registry write returns success even if the scheduled task subsequently fails, so verifying the actual cert state on the device is the only honest signal. The kit below is small enough to paste into a remote PowerShell session and big enough to be definitive. After reboot, re-run Get-UEFICertificate and confirm all four 2023 CAs are present.

Your 42-day plan in five steps, at a glance

How this fits with the rest of your in-flight Windows estate work

This rollover does not happen in isolation. Every UK SME running Windows is currently juggling at least three other estate-level workstreams, and Secure Boot 2023 has touchpoints with each. The most important one to be precise about is the Windows 10 14 October 2026 ESU cliff — same calendar quarter, same Windows estate, completely different event. Conflating them is the most common briefing-paper error in this space, and it leads to the wrong budget conversation with leadership.

Our prior coverage of the broader Windows estate transition lives at the Windows 10 October 2026 final cliff piece, which sets out the ESU side of the estate decision. The Cyber Essentials v3.3 control set that the A2.4 boot security control sits inside is detailed in the Cyber Essentials v3.3 Danzell deadline brief. For context on Microsoft platform reliability over the same window, our Microsoft 365 / Azure outage wave 2026 piece sits alongside this rollout. The wider patching cadence picture — this Patch Tuesday is not just the Secure Boot Tuesday — is in the Palo Alto PAN-OS zero-day action plan, which is sister coverage of this week. The breach-rate framing for leadership conversations is in the UK Cyber Security Breaches Survey 2025/2026 SME wake-up call piece. And the broader UK government posture on SME cyber resilience is set out in the UK cyber resilience pledge / CyberUK 2026 piece.

Frequently asked questions on the 2026 Secure Boot rollover

Where this leaves the UK SME conversation in May 2026

The Secure Boot 2023 rollover is the rare estate-level change that has all of the right properties for a clean managed rollout: it is calendar-driven rather than incident-driven, the deployment paths are well documented, the verification is mechanical, and the cost is engineering time rather than licence spend. The risk profile is asymmetric — doing it on time is uneventful, doing it late is an incident. The opportunity cost of a 12 May rollout is one Tuesday afternoon and one bundle of regular CU reboots. The opportunity cost of a 19 June rollout, even if it goes well, is having a meaningful percentage of your estate on the wrong side of the DBX revocation for some unbounded number of days while your team chases exceptions in the dark.

The Cyber Essentials v3.3 angle reinforces the calendar. A2.4 evidence is reviewed at renewal, and renewals happen on the anniversary of the original certificate. If your Cyber Essentials renewal falls in summer or autumn 2026, the assessor will look for evidence that the boot security posture was maintained continuously through the rollover — not just patched up the day before the assessment. That is a different evidence pack from a one-off remediation log, and it is much easier to produce if your rollout window was 12 May rather than 19 June minus three days.