aka.ms/getsecureboot explained
Updated
aka.ms/getsecureboot is the Microsoft short link to its main article about the Secure Boot certificates that started expiring in 2026. Windows itself points to it: the Windows Security app shows it in some Secure Boot status messages, which is why many people search for it after seeing a yellow or red badge.
Where the link goes
When we checked on 21 October 2026, aka.ms/getsecureboot forwarded to a Microsoft Support topic link, which then opened the article Windows Secure Boot certificate expiration and CA updates on support.microsoft.com (KB5062710). It is an information page. It does not download anything, and it does not ask you to sign in to read it. Microsoft can change where a short link points, so check the address bar after the page loads: it should be support.microsoft.com.
What Secure Boot is, in one paragraph
Secure Boot is a feature of UEFI firmware, the software that starts your PC before Windows loads. Microsoft explains that it checks the digital signature of each piece of start-up software against a list of trusted certificates stored in the firmware. If a boot loader is not signed by a trusted certificate, it is not allowed to run. This blocks a class of malware, often called bootkits, that tries to load before Windows and its security tools. Secure Boot was introduced with Windows 8 and is part of the Windows 11 requirements; see aka.ms/windowssysreq.
Why certificates are expiring
Since Secure Boot arrived, Windows PCs have carried the same set of Microsoft certificates, issued in 2011. Certificates have expiry dates, and Microsoft's article lists these replacements:
| Expiring certificate | Expiry date (per Microsoft) | Replaced by |
|---|---|---|
| Microsoft Corporation KEK CA 2011 | 24 June 2026 | Microsoft Corporation KEK 2K CA 2023 (signs updates to the DB and DBX lists) |
| Microsoft UEFI CA 2011 | 27 June 2026 | Microsoft UEFI CA 2023 (third-party boot loaders) and Microsoft Option ROM UEFI CA 2023 (option ROMs) |
| Microsoft Windows Production PCA 2011 | 19 October 2026 | Windows UEFI CA 2023 (signs the Windows boot loader) |
Microsoft says a device that has not received the 2023 certificates will continue to start and work normally, and ordinary Windows updates will still install. What it loses is the ability to receive new security protections for the early boot process, such as updates to Windows Boot Manager, the Secure Boot databases and revocation lists. Over time that leaves the PC less protected, and Microsoft warns that newer software that depends on Secure Boot trust may fail to load.
Do you need to do anything?
For most home PCs, no. Microsoft's guidance for personal devices running Windows 10 or Windows 11 Home, Pro or Education is that the new certificates arrive through normal Windows Update, and in many cases no action is needed. Microsoft asks you to make sure that:
- Windows is a supported version. Windows 10 support ended on 14 October 2025, so a Windows 10 PC only keeps getting security updates, including these, through the Extended Security Updates (ESU) program.
- Windows updates are not paused.
- Secure Boot is on. Press Windows key + R, type
msinfo32and press Enter. In System Information, look at Secure Boot State. If it says On, that part is fine.
If Secure Boot is off, Microsoft recommends checking with your device manufacturer about firmware updates before changing any Secure Boot settings. PCs managed by an employer or school are handled by their IT department, which has separate guidance from Microsoft.
Reading the Windows Security app
From April 2026, Microsoft began rolling out extra Secure Boot status information in the Windows Security app, under Device security > Secure Boot. The badge colours mean:
| Badge | What Microsoft says it means | What to do |
|---|---|---|
| Green | Protected, no recommended actions | Nothing. Microsoft adds that a green tick alone does not prove the certificates are updated: look for the text saying all required certificate updates have been applied. |
| Yellow | A safety recommendation, often a hardware or firmware limit that blocks the automatic update | Install all Windows updates, then contact your device manufacturer if the message mentions hardware or firmware limitations. |
| Red | A boot security update exists that cannot be delivered to the current boot configuration | Follow the guidance at aka.ms/getsecureboot and your PC maker's firmware advice. |
Some messages say the update is temporarily paused because of a known issue. Microsoft says no action is needed in that case; the update resumes automatically once the issue is resolved. Microsoft also advises against dismissing the warnings if your device has not yet received the updated certificates.
If something goes wrong after the update
Microsoft acknowledges that in a few cases a device might not start, or might ask for a BitLocker recovery key, after the new certificates are applied. For a BitLocker prompt, you need the 48-digit recovery key; our guides to aka.ms/recoverykey (personal accounts) and aka.ms/aadrecoverykey (work or school PCs) explain where it is usually saved. If the PC will not start at all, Microsoft's home-user article describes turning Secure Boot off in the firmware settings as a recovery step, and recommends contacting the device manufacturer if you have trouble. Treat that as a last resort and turn Secure Boot back on once the manufacturer has a fix.
Watch out for scams using this topic
An official warning in Windows Security is a natural hook for scammers. Microsoft's certificate update is delivered free through Windows Update and from your PC manufacturer. Nobody needs to connect to your PC remotely, sell you a "certificate renewal" or ask for payment to fix a Secure Boot badge.
Preparing to move from Windows 10 instead? The official installer is covered in aka.ms/downloadwindows11. Other Microsoft short links are listed in our aka.ms links directory.
Sources
Frequently asked questions
What is aka.ms/getsecureboot?
A Microsoft short link to the support article about the Secure Boot certificates that expire in 2026. On 21 October 2026 it opened that article on support.microsoft.com.
Will my PC stop working when the certificates expire?
Microsoft says devices without the new certificates keep starting and working, and normal updates still install. They stop receiving new boot-level security protections.
How do I check whether Secure Boot is on?
Run msinfo32 and look at Secure Boot State in System Information, or open Windows Security and go to Device security, then Secure Boot.
Why does Windows Security show a yellow Secure Boot badge?
Microsoft says a yellow badge usually means something, such as a hardware or firmware limitation, is blocking the automatic certificate update. Install updates and contact your device manufacturer.