Event details

It's time for our fourth Ask Microsoft Anything (AMA) about updating Secure Boot certificates on your Windows devices before they expire in June of 2026. If you've already bookmarked Secure Boot play...
Pearl-Angeles
Updated Apr 15, 2026
AMA
Romain-B's avatar
Romain-B
Copper Contributor
Apr 23, 2026

Will there be a situation where a device will be prevented from booting?
eg a moment where the 2011 certificate will be added to the DBX revocation list?

  • mihi's avatar
    mihi
    Brass Contributor
    Apr 23, 2026

    The most likely scenario is that the certificates and boot manager are updated, and then you reset certificates to default. In that case you need to run securebootrecovery.efi.

     

    Or when you later enable Secure Boot on a device installed without Secure Boot enabled with new boot manager, but the new certificates are not in the DB.

     

    Or when you boot an ISO from a manufacturer that has the new boot loader on another machine that does not have the certs.

    The system will not allow applying 2011 cert to DBX in case the system is still booted from that boot loader. So it can only happen with external media or when you manually downgrade your bootmanager after you added 2011 cert to DBX.