Here is the "magic" that non-security folks never see:
The 2011 certificates have a 15-year lifespan and are scheduled to . microsoft root certificate authority 2011cer work
You can thank the (Microsoft Root CA 2011). Here is the "magic" that non-security folks never