Update for my Surface Pro 2 Laptop

David Gardner 0 Reputation points
2026-07-08T10:19:38.36+00:00

Last week my laptop brought in 2020 failed to boot all I got was a box stating window secure boot error after looking about on my main pc to find out that the last update changed my boot record. I even did a reset hoping it would work so I am booting without Microsoft's secure boot. I did read somewhere that the last update included an extension date to the boot file but that doesn't seem to be the case on my laptop. Would appreciate any advice to rectify Thankyou in advance.

Surface | Surface Laptop | Install and update
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. S.Sengupta 32,021 Reputation points MVP Volunteer Moderator
    2026-07-08T23:52:05.1633333+00:00

    Microsoft has been updating Secure Boot certificates that were originally issued in 2011, since those older certificates begin expiring in June 2026. The "Microsoft Corporation KEK CA 2011" certificate expired on June 24, 2026, "Microsoft UEFI CA 2011" expired on June 27th, and "Microsoft Windows Production PCA 2011" is the last to go, expiring October 19, 2026. Most devices are meant to get the newer 2023 certificates automatically, and many OEMs provide firmware updates when needed — but on some machines (especially 2020-era laptops with older firmware), that update either didn't land properly or the firmware couldn't accept it, which is very likely what caused your boot failure.

    Ref:

    Windows Secure Boot certificate expiration and CA updates

    1. Check Windows Security → Device Security → Secure Boot for a green/yellow/red badge.
    2. Visit Microsoft's Surface Secure Boot Certificates support page to see if your exact model is eligible for updates.
    3. Only Surface devices from 2024+ have the new certificates built in — older models get them via Windows Update, if still supported.
    4. Manual update (if your model qualifies):
      • Hold Volume-Up + Power → boot into UEFI
      • Go to Security → Secure Boot → Change Configuration

    Was this answer helpful?

    0 comments
  2. Sin-D 12,260 Reputation points Microsoft External Staff Moderator
    2026-07-08T23:41:40.9833333+00:00

    Hi David Gardner,

    I understand how concerning it is when a device that was previously working suddenly stops booting and starts showing Secure Boot errors.

    Before suggesting further steps, could you confirm the exact Surface model you are using? Your post title mentions Surface Pro 2, but you also stated the device was purchased in 2020, so I'd like to make sure we're troubleshooting the correct hardware.

    In the meantime, if this is a Surface device from around 2020 that can still access Windows:

    1. Open "Windows Update" and install all available updates, including optional firmware updates.
    2. Restart the device after updates complete.
    3. Open "Windows Security" > "Device Security" and check whether Secure Boot is reported as enabled and healthy.
    4. If you previously changed Secure Boot settings in Surface UEFI, avoid making additional changes unless you have access to your BitLocker recovery key.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.