vCenter 9.1.1.0 Automates Secure Boot Certificate Remediation Before the 2011 Certs Fully Expire
vCenter Server 9.1.1.0, released September 3, 2026, adds automated remediation for a real, time-sensitive problem: Microsoft’s original 2011 Secure Boot certificates began expiring this year, and any Secure Boot-enabled VM still relying on them will stop receiving security fixes for the Windows Boot Manager once the relevant certificate expires. If you’re running vSphere with Secure Boot-enabled VMs created before 2023, this release is worth understanding now, not after a VM silently loses boot security patching.
Why this matters: the 2011 certificate expiration isn’t hypothetical
The Microsoft Corporation KEK CA 2011 expired June 24, 2026. The Microsoft Corporation UEFI CA 2011 expired June 27, 2026. The Microsoft Windows Production PCA 2011 expires October 19, 2026, which at the time of this writing is still ahead. Virtual machines are a genuinely special case here: hypervisors that emulate UEFI, including VMware, Hyper-V, and KVM, maintain their own NVRAM-based certificate stores independent of the guest OS, and by default, many VMs created before 2023 only ever received the original 2011 certificates in that store. A VM relying solely on expired 2011 certificates can still boot and receive standard Windows updates, but it stops receiving security fixes specifically for the Windows Boot Manager and other Secure Boot components, a meaningful, silent gap in your security posture that won’t show up as an obvious error.
What vCenter 9.1.1.0 actually adds
This is a maintenance release focused on supportability rather than major new capability, and the Secure Boot PK (Platform Key) remediation work is the standout piece for admins managing Secure Boot-enabled VMs:
- A new vCenter alarm that proactively warns administrators when a Secure Boot-enabled, powered-on VM has an out-of-date NULL PK, surfacing the problem before it becomes a silent patching gap rather than requiring admins to manually audit every VM’s certificate store.
- Automatic remediation for VMs without a vTPM: vCenter now automatically updates the out-of-date NULL PK on Secure Boot-enabled VMs that don’t have a virtual Trusted Platform Module, during a guest reboot, closing the gap without requiring manual intervention on every affected VM.
VMs that do have a vTPM configured are a different case, and this automated remediation is specifically scoped to VMs without one, so don’t assume every Secure Boot VM in your environment gets fixed automatically just by upgrading vCenter. Confirm which of your VMs actually qualify for the automatic path versus which need manual attention.
Other changes in this release
vCenter 9.1.1.0 also adds IPv6 support for the license server (static addressing or DHCPv6/SLAAC), and VCF Operations now manages additional OS and application accounts while displaying the last password update date for managed accounts, useful for auditing credential rotation compliance across managed systems without needing a separate tool for that specific check.
What to actually do
# After upgrading to vCenter 9.1.1.0, check for the new Secure Boot PK alarm
# on any VM created before 2023 with Secure Boot enabled
# For VMs WITH a vTPM configured, the automatic remediation does not apply,
# these need manual certificate store updates, plan for that separately
# General inventory step regardless of vCenter version: identify every
# Secure Boot-enabled VM in your environment and confirm whether its
# certificate store includes the 2023 certificate chain, not just 2011Even if you’re not ready to upgrade vCenter to 9.1.1.0 immediately, the underlying certificate expiration timeline doesn’t wait for your upgrade schedule. Inventory your Secure Boot-enabled VMs now, specifically checking whether each one’s certificate store has been updated to include the 2023 certificate chain, independent of whatever vCenter version you’re currently running.
Frequently asked questions
Will my Secure Boot-enabled VM stop booting once the 2011 certificates expire?
No, a VM relying on expired 2011 certificates can still boot and continue receiving standard Windows updates. What stops is security patching specifically for the Windows Boot Manager and other Secure Boot components, a gap that’s easy to miss precisely because nothing visibly breaks.
Does upgrading to vCenter 9.1.1.0 automatically fix every affected VM?
Only VMs without a vTPM get the automatic NULL PK remediation during a guest reboot. VMs with a vTPM configured need separate, manual attention, don’t assume the upgrade alone resolves your entire Secure Boot certificate exposure across every VM in the environment.
We’re not planning to upgrade vCenter soon. Does this certificate issue still affect us?
Yes, the certificate expiration timeline is independent of your vCenter version, it’s about what certificates exist in each individual VM’s NVRAM store. Inventory your Secure Boot-enabled VMs and their certificate chains regardless of your vCenter upgrade timeline, since the underlying exposure exists whether or not you have the new automated remediation available yet.
