Microsoft has started issuing the new Secure Boot certificates for Windows computers. It affects all currently active versions, Windows Server and client versions for business, consumer and education. This includes machines running Windows 11 as well as those run by Windows 10 that have activated the extended security program.
Microsoft has been warning for months about an important situation for the security of the entire Windows ecosystem. And the initial certificates for the Secure Boot feature are reaching the end of their planned useful life after 15 years and are scheduled to expire in June 2026. Something that IT professionals must take into account.
The program represents one of the increased coordinated security maintenance efforts for the entire ecosystem, covering Windows maintenance, firmware updates, and millions of unique device configurations provided by hardware manufacturers or original equipment manufacturers (OEMs) around the world.
The importance of Secure Boot certificates
Nuno Costa, head of Windows Service and Delivery at Microsoft, has detailed the importance of the renewal and its application on all Windows machines.
Secure Boot is a critical security feature of Windows and Windows Server, providing protection from the moment the device is turned on. Introduced in 2011, Secure Boot runs at startup (before Windows loads) y helps ensure that only trusted, digitally signed software runs. By blocking untrusted code early in the boot process, Secure Boot helps protect against sophisticated threats that may be difficult to detect later.
This trust is reinforced by certificates stored in the PC firmware. After more than 15 years of continuous service, the original Secure Boot certificates are reaching the end of their expected life cycle and will expire at the end of June 2026.
As cryptographic security evolves, Certificates and keys must be updated periodically to maintain strong protection. Retiring old certificates and introducing new ones is a common industry practice that helps prevent outdated credentials from becoming a weak point and keeps platforms aligned with modern security expectations.
Ecosystem preparation
Because Secure Boot works at the firmware level and affects the startup of PCs, these changes have required careful preparation to minimize disruptions while maintaining the security and reliability of devices at scale.
This work involved a close collaboration with device manufacturers and firmware providers responsible for the Unified Extensible Firmware Interface (UEFI) using a standards-based approach. This effort also included the addition of service capabilities and tools to facilitate a gradual and monitored deployment, as well as firmware improvements to ensure the secure application of certificate updates, explains Costa:
“Our ecosystem partners play a critical role in the transition to the new Secure Boot certificates. Original equipment manufacturers (OEMs) have been rolling out updated certificates on new devices and many newer PCs manufactured since 2024, and almost all devices shipped in 2025 already include the certificates and require no action from customers. “OEM partners have also worked closely with our engineering teams to ensure that devices available on the market can apply updates seamlessly and have provided their own guidance to help customers prepare for the transition.”.
What will happen when the certificates expire?
If a device does not receive the new Secure Boot certificates before the 2011 certificates expire, the PC will continue to function normally and existing software will continue to run. However, the device will enter a degraded security status which limits your ability to receive future protections at the startup level.
As new vulnerabilities are discovered for the boot system, affected systems become increasingly exposed as they can no longer install new mitigations. Over time, this can also lead to compatibility issues, as newer operating systems, firmware, hardware, or Secure Boot-dependent software may not load.
It is important to note that devices with unsupported versions (Windows 10 and earlier, except those that have subscribed to Extended Security Updates) They will not receive Windows updates or new certificates. “We recommend customers always use a supported version of Windows for the best performance and protection”says the Microsoft executive.
What actions should users and companies take?
For most businesses and consumers who let Microsoft manage their PC updates, new certificates will be installed automatically through the monthly Windows update process, without the need to take any additional action. Some specialized systems, such as certain servers or IoT devices, may follow different upgrade processes and should be evaluated as part of deployment planning.
For a fraction of devices, a manufacturer-independent firmware update may be required before the system can apply the new Secure Boot certificates provided through Windows Update. To prepare, we recommend customers check their OEM support pages to ensure they have the latest firmware updates.
In the coming months, the Windows Security application will include messages about the certificate update status so that users can more accurately track updates.
For organizations, the new certificates will be delivered through regular monthly Windows updates, where devices provide sufficient diagnostic data to validate readiness. In scenarios where devices cannot be reliably validated through this approach, organizations should plan the implementation and monitoring of new certificates using the IT administrator’s manual and your existing management tools.
A secure foundation for the future
The update to the Secure Boot certificate marks a generational renewal of the foundation of trust that underpins the startup of modern PCs. By renewing these certificates, the Windows ecosystem ensures that future innovations in hardware, firmware, and operating systems can continue to be based on a secure boot process and aligned with the industry.
Security at this level is not a one-time event, but rather a continued responsibility shared between Microsoft and the broader PC ecosystem. “Throughout this effort, we have valued the collaboration of device manufacturers and firmware partners to achieve an efficient and secure deployment. This collaboration has focused on proactive planning, transparency and providing the visibility, tools and guidance clients need to navigate the transition with confidence.they explain from Microsoft.
