When will the new Secure Boot certificates be rolled out by Microsoft?

New Secure Boot certificates started rolling out with the Windows 11 KB5074109 update last month and will be deployed as part of regular Windows platform updates.

What happens if my Windows device's Secure Boot certificate expires?

PCs will continue to function but enter a degraded security state, potentially limiting future boot-level security updates and causing compatibility issues with future hardware or software.

Do I need to take action for the new Secure Boot certificates on Windows 11?

For the vast majority of Windows 11 users, the new certificates will be installed automatically with no additional action required.

Home / Technology / Microsoft's Secure Boot Gets a Refresh Before Expiration

Microsoft's Secure Boot Gets a Refresh Before Expiration

10 Feb

•

Summary

New Secure Boot certificates are automatically replacing expiring ones.
Certificates set to expire between June and October 2026.
Update ensures continued security and compatibility for Windows devices.

Microsoft's Secure Boot Gets a Refresh Before Expiration

Microsoft is proactively replacing boot-level security certificates on Windows devices to ensure continued protection. The existing Secure Boot certificates, introduced in 2011, are scheduled to expire between June and October 2026. These new certificates are being deployed through routine Windows platform updates, a process Microsoft describes as a "generational refresh" of its security standards.

The automatic rollout aims to maintain strong security and prevent devices from entering a degraded state. While expired certificates won't stop PCs from functioning, they could limit future security updates and cause compatibility issues with newer hardware or software. The update process is largely automatic for Windows 11 users, with new certificates beginning to deploy via the KB5074109 update last month.