Microsoft to Update Secure Boot Certificates Before June 2026 Expiration

Microsoft is proactively updating Secure Boot certificates, initially issued in 2011, which are set to expire starting in June 2026. Secure Boot is a security feature that ensures only trusted software runs during a device's startup sequence, protecting against boot-level malware.

For most users, the updated certificates will be delivered automatically through Windows Update, requiring no action. However, some devices may need firmware updates from their original equipment manufacturers (OEMs). Microsoft advises users to keep their systems updated to maintain optimal security.

Devices running unsupported versions of Windows, such as Windows 10 without Extended Security Updates (ESU), will not receive the new certificates. While these devices will continue to operate, they will lack the latest security protections, increasing vulnerability to emerging threats.

To verify if your device has the updated Secure Boot certificates, Microsoft provides guidance on checking the certificate status. Users are encouraged to ensure their systems are up to date to maintain security and functionality.

"Devices that haven’t received the newer 2023 certificates will continue to start and operate normally... However, these devices will no longer be able to receive new security protections for the early boot process."