Microsoft's Secure Boot Gets a Refresh Before Expiration

Microsoft is proactively replacing boot-level security certificates on Windows devices to ensure continued protection. The existing Secure Boot certificates, introduced in 2011, are scheduled to expire between June and October 2026. These new certificates are being deployed through routine Windows platform updates, a process Microsoft describes as a "generational refresh" of its security standards.

The automatic rollout aims to maintain strong security and prevent devices from entering a degraded state. While expired certificates won't stop PCs from functioning, they could limit future security updates and cause compatibility issues with newer hardware or software. The update process is largely automatic for Windows 11 users, with new certificates beginning to deploy via the KB5074109 update last month.

Specific device types, such as servers and IoT devices, might follow different update protocols. Additionally, a small percentage of devices may require a separate firmware update from their manufacturers. Windows 10 users need to be enrolled in Extended Security Updates to receive these new certificates. Microsoft advises users to check OEM support pages for any device-specific instructions.