An up-to-date Windows installation or an expired certificate does not, by itself, show whether Microsoft Windows Production PCA 2011 has been revoked in UEFI’s DBX. Secure Boot checks, certificate updates and revocation describe separate parts of the boot process, so one status cannot stand in for the others.
Treat Secure Boot being enabled, replacement certificates being installed and old boot-manager trust being revoked as separate checks.
What a Secure Boot check measures
Secure Boot is a UEFI firmware feature that checks signatures on software loaded before Windows starts. Its allowed-signature database is called DB; its list of blocked signatures is DBX. An enabled Secure Boot setting tells you about that feature’s configuration. It does not, on its own, tell you whether PCA 2011 has been added to DBX.
Microsoft describes BlackLotus as using CVE-2022-21894, also known as Baton Drop, to roll Windows boot managers back to vulnerable versions that were absent from DBX. Microsoft says earlier boot-manager mitigations had been bypassed in multiple cases and describes revoking Microsoft Windows Production PCA 2011 as a broader measure. A regular Windows update, Secure Boot being enabled and that specific DBX revocation are distinct security states. Microsoft’s boot-manager guidance
Expiration, replacement and revocation are different
Microsoft lists the following 2011 certificate expiration dates. Each date had passed by November 7, 2026. Expiration alone does not revoke the trust used by older boot managers; the replacement certificates and the separate DBX revocation have different roles.
| 2011 certificate and scope | Expiration date | 2023 replacement | Firmware database |
| Microsoft Corporation KEK CA 2011 | June 24, 2026 | Microsoft Corporation KEK 2K CA 2023 | KEK |
| Microsoft UEFI CA 2011, for third-party bootloaders and EFI applications | June 27, 2026 | Microsoft UEFI CA 2023 | DB |
| Microsoft UEFI CA 2011, for option-ROM signing | June 27, 2026 | Microsoft Option ROM UEFI CA 2023 | DB |
| Microsoft Windows Production PCA 2011, for Windows boot managers | October 19, 2026 | Windows UEFI CA 2023 | DB |
Microsoft says devices without the newer 2023 certificates can continue to start and receive standard Windows updates, but they do not receive new early-boot security protections and related Secure Boot updates. The certificate transition and its effects are described in Microsoft’s Secure Boot update guidance.
What must happen before PCA 2011 is revoked
Microsoft’s sequence is to update DB and deploy boot-manager components signed by Windows UEFI CA 2023 before applying the PCA 2011 revocation to DBX. It also advises testing representative devices, keeping firmware current and backing up BitLocker recovery keys before deployment.
On a Secure Boot-enabled device, revoking PCA 2011 prevents Windows boot managers signed by that certificate from starting. That can also affect older recovery media, USB boot media and network-boot components that rely on those managers. Microsoft warns that applying the DBX revocation before updating DB can leave a device unable to boot and bypass Windows Update safety checks. Microsoft’s deployment guidance
What a status check cannot tell you
Secure Boot’s enabled state and the presence of a revocation in DBX describe configuration and trust. Neither is a scan for a bootkit already on the PC, so neither alone establishes whether a device is free of an existing infection.
