Microsoft is refreshing Secure Boot certificates, so you might need to update Windows

Introduced in 2011, Secure Boot is a Windows-based security feature that runs during a system's initial boot, before the OS, to ensure that only digitally signed software can run. Secure Boot certificates are stored in the Unified Extensible Firmware Interface (UEFI) firmware, preventing untrusted code and threats from executing.

2

The only problem is that Secure Boot certificates expire after 15 years, so the first Secure Boot certificates for Windows 10 and 11 systems are set to reach the end of their lifespan as of late June 2026. The good news is that Microsoft has begun issuing new certificates as part of Windows 10 and Windows 11 updates for personal users, businesses, and education. But it's a massive undertaking.

"Refreshing new certificates represents one of the largest coordinated security maintenance efforts across the Windows ecosystem, spanning Windows servicing, firmware updates, and millions of unique device configurations," Microsoft writes in its blog post announcing the rollout.

The company confirms that new systems purchased or obtained in 2024 and 2025 should be fine, as Microsoft has been working with its OEM partners since then, providing new certificates. It's unclear whether PC DIY enthusiasts will be required to obtain and install new BIOS firmware for their motherboards, or if a Windows update is sufficient in most cases. Microsoft confirms that a "fraction of devices" will require third-party intervention.

The rollout has begun and will be gradual, as millions of PCs and systems need to be updated, with some requiring UEFI BIOS updates in order to obtain fresh certificates. Microsoft confirms that for systems where Secure Boot certificates have expired, Windows will continue to "function normally" and software will run; however, "the device will enter a degraded security state that limits its ability to receive future boot-level protections."

"As new boot‑level vulnerabilities are discovered, affected systems become increasingly exposed because they can no longer install new mitigations," Microsoft continues. "Over time, this may also lead to compatibility issues, as newer operating systems, firmware, hardware, or Secure Boot-dependent software may fail to load."