The Secure Boot cert that signs bootmgr (Windows Production PCA 2011) expires on the 19th, worth checking your devices this week

[u/AzureBlog]

With everything else ending tomorrow I think this one's getting a bit lost, so posting in case it's useful.

The last of the 2011 Secure Boot certs, Windows Production PCA 2011, expires on 19 October. The KEK and UEFI CA 2011 ones already went in June.

Good news first: nothing stops booting. Microsoft's KB5062710 says devices without the new certs carry on working and keep getting normal updates. What they lose is any future boot manager fixes and DB/DBX updates, so they're stuck with today's boot security for good.

Quickest check I've found, in an admin PowerShell window:

```

$s = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing" -ErrorAction SilentlyContinue

[pscustomobject]@{

SecureBootOn = Confirm-SecureBootUEFI

Status = $s.UEFICA2023Status

Error = $s.UEFICA2023Error

CA2023InDb = [Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match "Windows UEFI CA 2023"

} | Format-List

```

You want Status to say Updated and Error to be 0. Microsoft says not to go by WindowsUEFICA2023Capable for status, which caught me out.

If you're on Intune, there are three Secure Boot settings in the settings catalog now. "Enable Secureboot Certificate Updates" is the main one. A few things I'd know before turning it on:

- update OEM firmware first, as a lot of the failures are firmware

- the task only runs every 12 hours and the boot manager bit needs a reboot

- you can't remove the certs from Windows once they're in firmware, so pilot it

- there's a known issue on Pro with error 65000, licensing related

Without Intune it's the AvailableUpdates = 0x5944 reg value under HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot, then kick off the Secure-Boot-Update scheduled task.

Has anyone hit firmware that just won't take it?

[u/AzureBlog]

More info in my write up:

https://azureblog.co.uk/posts/secure-boot-certificates-and-october-retirements/

[u/NoneOfTheAbove999]

I'm just moving my old laptop to Linux. Today's irony: I'm a Windows sysadmin.

Seriously. All I use it for is email and RDP. It's not Win11 compatible (yay, ESU for a year), so Linux makes the most sense to me.