Secure boot certificate expired‎

Question

Please refer to the screenshots, in two Microsoft articles as screenshots related to secure boot certificate expired, it mentioned that the following certificates will expire: Microsoft Corporation KEK CA 2011 and Microsoft Corporation UEFI CA 2011 (or third-party UEFI CA) , the Windows device with these certificates will be affected after June 2026. Here's my questions: 1.Whether if secure certificate expired will affect those device without enabling secure boot ? 2.If the device enabled secure boot with 2011 certificates, what it will happen when secure certificate expired？ 3.How to check if device enabled secure boot and which secure boot certificates the device owned? 4.How to export device list of secure boot certificate info for all managed device on Intune? Such all secure boot certificate from Windows device.2026-01-13 17_18_06.png 2026-01-13 17_17_51.png

Answer 1

Hi Sugus Chen,

1. Devices with Secure Boot disabled will not be directly affected by the expiration of the 2011 certificates. However, enabling Secure Boot later without updated certificates may cause boot failures or prevent future updates from applying.
2. Devices with Secure Boot enabled and still using 2011 certificates will lose the ability to apply Secure Boot updates, validate bootloaders, and may fail to boot after June 2026. Microsoft will roll out updated 2023 certificates via Windows Update and OEM firmware updates, so it’s critical to apply those in advance.
3. To check Secure Boot status and certificate details locally, you can run:

Confirm-SecureBootUEFI

and use tools like Get-SecureBootPolicy or UEFI Firmware Settings via msinfo32.

4. For Intune-managed devices, you can use Proactive Remediation scripts or custom inventory scripts to collect Secure Boot status and certificate info. Several community guides offer sample scripts that query UEFI variables and export results to Log Analytics or Endpoint reports.

I hope this helps clarify the impact and next steps. If you find this answer helpful, please hit “Accept Answer” so I know your concern is resolved.

Jason.

Answer 2

Hi Sugus Chen,

Just checking in, were you able to get the issue resolved? If so, it would be great if you could mark the answer as Accepted so others in the community can benefit from your experience. Thank you!