To check whether Secure Boot certificate updates are complete on Windows 10 or Windows 11, open Windows Security > Device security > Secure Boot and read the full status message. A green checkmark alone does not confirm that the certificates are up to date.
Secure Boot uses UEFI firmware to verify trusted software before Windows starts.
Check the certificate status in Windows Security
On a supported Windows 10 or Windows 11 PC:
- Open Windows Security.
- Select Device security.
- Select Secure Boot.
- Read the full status text. The completion message is: “Secure Boot is on and all required certificate updates have been applied. No further certificate changes are needed.” Microsoft says no further certificate changes are needed when this appears.
Match other status messages to the next step
Microsoft describes several states that call for different responses:
| Windows Security status | What it means | What to do |
| Older boot trust configuration | The device is using an older configuration that should be updated. | Install the latest Windows updates and restart if prompted. |
| Update paused for a known issue | A compatibility issue has paused the update. | Microsoft says the pause resumes automatically. |
| Not enough information to classify the device | Windows cannot determine the device’s status. | Follow Microsoft’s Secure Boot guidance for this state. |
| Hardware or firmware limitation | The device does not support the automated certificate update. | Contact the device manufacturer for assistance. |
| Requires action | A security update for the Windows boot experience cannot be delivered to the current boot configuration. | Review the action details shown in Windows Security. |
A generic message saying Secure Boot is enabled reports that the feature is on; it does not confirm whether certificate updates are complete. The certificate-aware status enhancements began rolling out in April 2026, and their availability can vary by device. On enterprise-managed devices, Secure Boot-specific badges and notifications are disabled by default.
What missing replacement certificates mean
Microsoft listed June 24, June 27, and October 19, 2026, as the expiration dates for the Microsoft Corporation KEK CA 2011, Microsoft UEFI CA 2011, and Microsoft Windows Production PCA 2011 certificates, respectively. Devices without replacement certificates continue to start and receive standard Windows updates, but they do not receive new security protections for the early boot process.
