In 2026, nothing \"visible\" to most users changes. The computer turns on, Windows loads, everything seems the same. But underneath, something important changes: the foundation upon which the system decides what to trust at startup.<\/p>\n
This isn't a typical update or just another patch. What's expiring are certificates that are part of the boot chain of trust. To put it more simply: the firmware will no longer rely on references that were previously valid.<\/p>\n
That doesn't break the equipment, but it does change the verification level. And that kind of change is easy to overlook because it doesn't generate obvious errors.<\/p>\n
Secure Boot acts before the operating system has a chance to intervene. It checks digital signatures using keys stored on the platform itself (PK, KEK, db, dbx). As long as these keys are up to date, the filter works. When they become outdated, the system still boots\u2026 but with less certainty.<\/p>\n
The problem isn't immediate, but rather gradual. The system doesn't become insecure overnight, but it loses its ability to detect modifications to boot components. And that opens up a vulnerability that isn't typically monitored by traditional tools.<\/p>\n
The certificates issued in 2011 \u2014as Microsoft Corporation KEK CA 2011<\/i> or UEFI CA 2011<\/i>\u2014 they have an expiration date. In this cycle, that limit falls between June and October 2026.<\/p>\n
This doesn't mean the system stops working. What happens is more subtle: if those authorities aren't updated, the validation stops relying on a current chain.<\/p>\n
Microsoft already considered this scenario with a new authority (2023 Microsoft Windows PCA<\/i>) which is distributed via Windows Update on compatible computers. Under normal conditions, the process is automatic.<\/p>\n
The differences begin with the equipment that is not within that \"normal flow\": unsupported systems, altered configurations, or firmware that does not easily accept new keys.<\/p>\n
There's no clear warning there. The equipment is still working, but the validation is no longer equivalent to what it was before.<\/p>\n
At first glance it may seem like a general problem, but in reality it depends quite a lot on the context.<\/p>\n
There are cases where it's worth looking at this more closely:<\/p>\n