Last updated:
On October 19, 2026, the Microsoft Windows Production PCA 2011 certificate expired after 15 years.
Nevertheless, Windows servers, virtual machines and workstations continue to start normally.
The actual problem will emerge with future updates.
🔍 What has Microsoft changed?
Microsoft has frozen bootloaders signed with PCA 2011.
This means:
* Existing Windows installations continue to boot.
* Regular Windows updates generally continue to work.
* New bootloader security fixes use the Windows UEFI CA 2023 certificate chain.
* Future installation media increasingly rely on the new certificate chain.
Systems that trust only the old certificate gradually lose important security updates for the boot process.
⚠️ Particularly relevant for virtualized infrastructure
This issue should not be underestimated with Hyper-V, VMware vSphere, Citrix MCS and golden images.
A fully patched Windows installation does not automatically mean that the virtual UEFI firmware supports the new certificates.
Hyper-V Generation 2: certificate updates are delivered through Windows servicing.
VMware vSphere: the ESXi version and virtual hardware must support the new certificates.
Golden images: the bootloader trust chain must also be correct.
🛠️ What should you check?
An initial PowerShell test:
|
1 2 |
Confirm-SecureBootUEFI |
But be careful: True confirms only that Secure Boot is enabled, not whether Windows UEFI CA 2023 has already been installed.
Also:
✅ Check the UEFI certificate status
✅ Check hypervisor and VM hardware versions
✅ Test installation and recovery media
✅ Back up BitLocker recovery keys before making changes
✅ Check WDAC/App Control policies for dependencies on PCA 2011
🔬 An often overlooked detail
Windows Defender Application Control (WDAC) may also be affected.
If old Microsoft certificates are explicitly embedded in policies, updated Windows components may be blocked in the future.
Event ID 3077 in the Code Integrity event log can indicate such blocks.
💡 My takeaway
Secure Boot enabled ≠ Secure Boot ready for future updates.
Certificate expiration does not cause an immediate boot failure, but it changes the foundation for future bootloader updates.
Especially in virtualized infrastructure, the firmware trust chain should therefore be checked alongside the Windows patch level.
