La fecha límite de Secure Boot de octubre de 19 se cruza con la atestación de juegos: lo que deben saber jugadores y laboratorios

Two platform-security stories are converging this autumn, and most PC players will only notice when a game refuses to launch. The first is a quiet, industry-wide deadline: the last of Microsoft’s original 2011 Secure Boot certificates expires on October 19, 2026. The second is louder: big competitive titles now treat TPM 2.0 and Secure Boot as entry requirements for online play, and Call of Duty: Modern Warfare 4 arrives in late October with both switched on.

This guide explains what each change means, why they are connected, and what enthusiasts, lab owners, and researchers should check before the end of October. There is nothing to hack or bypass here. The whole point is to keep machines on the trusted path.

The certificate rollover in plain terms

Secure Boot works by checking signatures on pre-boot code against a short list of trusted certificates stored in UEFI firmware. According to Microsoft’s support article on the rollover (KB5062710), every Windows device that supported Secure Boot has shipped with the same set of Microsoft certificates since 2011, and those certificates expire during 2026:

• Microsoft Corporation KEK CA 2011 expired on June 24, 2026. It authorizes updates to the allow list (DB) and the revocation list (DBX). Its replacement is Microsoft Corporation KEK 2K CA 2023.
• Microsoft UEFI CA 2011 expired on June 27, 2026. It signs third-party boot loaders and option ROMs. It is being replaced by two separate 2023 certificates, one for boot loaders and one for option ROMs.
• Microsoft Windows Production PCA 2011 expires on October 19, 2026. It signs the Windows boot loader itself. Its replacement is Windows UEFI CA 2023.

Microsoft is clear that a device without the 2023 certificates does not stop booting when the old ones expire. It keeps running and still receives normal Windows updates. What it loses is the ability to receive new early-boot protections: updates to Windows Boot Manager, the Secure Boot databases, revocation lists, and mitigations for newly discovered boot-level vulnerabilities. Over time, that machine falls behind on protection at exactly the layer attackers find most valuable.

Who is most likely to be left behind

Microsoft says most devices will get the new certificates automatically through Windows Update, with OEM firmware updates where needed. An August 14 guide from endpoint management company Lakeside Software adds a useful list of where the gaps tend to cluster:

• Older PCs and servers that no longer receive OEM firmware updates.
• Air-gapped and offline machines that Windows Update cannot reach.
• Virtual machines, since each VM has its own firmware certificate store and updating the host does not update the guests.
• Dual-boot systems, where the Linux shim needs to be trusted under the 2023 chain.

That list will look familiar to anyone who runs a hardware security lab. Test benches, isolated research machines, and VM-heavy setups are exactly the systems that drift out of date. Lakeside also points out that most scanners and EDR tools do not read UEFI variables, so many teams cannot easily see which machines still rely on the 2011 chain.

Where games come in

Now the second story. Activision’s support page on TPM 2.0 and Secure Boot states that both are required to play Call of Duty: Black Ops 7, Call of Duty: Warzone, and the Modern Warfare 4 beta. The listed prerequisites are basic platform hygiene: UEFI boot mode rather than Legacy, a GPT system disk rather than MBR, Secure Boot enabled, and, on Windows 10, version 22H2 or later.

GosuGamers reported in late September that Team RICOCHET confirmed TPM 2.0 and Secure Boot are mandatory for Modern Warfare 4 online play, describing them as a trusted security foundation for its anti-cheat. The same report said some compatible PCs still fail attestation. According to the RICOCHET team’s data as quoted there, systems labeled “AMD 3.x.0.x” were the most common issue in failure reports, and Lenovo systems were over-represented. The team said it was working with Microsoft and hardware makers, had updated its Secure Attestation Wizard, and was collecting reports through a dedicated form. For some Lenovo systems, the report said the needed BIOS update is available only by contacting Lenovo directly.

A support article from PC builder Aftershock ties the two stories together. It lists outdated Secure Boot certificates alongside old BIOS versions, disabled TPM, Legacy boot mode, and MBR disks as causes of “Failed Attestation Status” errors, and says that recent certificate changes mean some older systems need extra configuration before the game can verify them.

In other words, the certificate rollover is not just an enterprise IT chore. For a growing number of competitive games, a stale firmware trust store can be the difference between joining a match and staring at an error.

A calm checklist before late October

None of this calls for risky tinkering. The safest path is the vendor-supported one:

1. Check your firmware first. Visit your motherboard or laptop manufacturer’s support page and install the current stable BIOS or UEFI release. Newer firmware is how most systems pick up the 2023 certificates and TPM fixes.
2. Back up your BitLocker recovery key. Lakeside recommends this before any Secure Boot change on an encrypted drive. It takes a minute and avoids a very bad afternoon.
3. Let Windows Update finish. Microsoft is rolling out the certificate update to eligible devices. Reboot when prompted.
4. Confirm boot mode and disk style. UEFI and GPT are prerequisites for Secure Boot and for the attestation checks games use.
5. Use the official tools. If a game reports an attestation failure, follow the publisher’s own wizard and support guidance instead of third-party “fixes.”
6. Include lab machines and VMs. Research benches and virtual machines need the same attention, and often more.

What Secure Boot does not do

Enthusiasts sometimes treat Secure Boot as a general shield against low-level threats. It is narrower than that. Secure Boot checks what code is allowed to run before the operating system starts. It does not decide which PCIe devices can read or write memory once Windows is up.

That job falls to a separate layer. Microsoft’s documentation describes Kernel DMA Protection as a feature that uses the system IOMMU to stop external peripherals, such as Thunderbolt, USB4, and CFexpress devices, from performing DMA unless their drivers support memory isolation through DMA remapping. Microsoft also notes that it protects only after the OS has loaded, and that protecting the boot phase is the firmware’s job. Checking it is simple: Windows Security shows it under Device security, Core isolation details, Memory access protection.

For defenders, the lesson is to build a layered picture. Secure Boot and TPM measurements establish that the boot chain is trustworthy. IOMMU-backed protections limit what devices can touch at runtime. Anti-cheat and integrity systems then build on both. Each layer covers gaps the others leave, which is why game publishers increasingly ask for the whole stack rather than a single checkbox.

The takeaway

October 19 will pass without drama on most PCs. For the machines that miss it, the cost shows up slowly: missing boot-level fixes, attestation failures, and a trust store that no longer matches what the rest of the ecosystem expects. Players who want smooth access to attestation-gated games, and labs that want realistic, well-maintained test systems, have the same to-do list. Update firmware, let the certificate rollover complete, check that memory access protection is on, and use official tools when something fails. Keeping the trusted path intact is dull work, and it now affects both platform security and whether you can get into a match.