Microsoft has announced that the original Secure Boot certificates that were issued when the feature first began shipping 2011 are set to expire this June, and that PCs which are not up to date will enter a degraded security state when this happens. This is the first time since Secure Boot was introduced that its certificates are expiring.
Secure Boot is a security feature that ships as part of Windows PCs, and is on by default. It protects your PC from certain security vulnerabilities that could be exploited during the boot phase, before Windows even fully loads, and ensures only signed code can run during this phase.
Pretty much all PCs that have shipped since 2011 include Secure Boot, and so most Windows users are going to be impacted by these Secure Boot certificates expiring. Microsoft says that most PCs will automatically be updated with new Secure Boot certificates via Windows Update, but that some PCs will need an additional firmware update issued by their OEM too.
Most PCs that have shipped since 2024 already have these updated Secure Boot certificates, and so there’s nothing you need to worry about if you’re using a Windows PC that shipped in the last couple of years.
If you’re using an older PC that’s running a version of Windows that’s no longer supported, you will not receive updated Secure Boot certificates. Microsoft says that functionally, nothing will immediately change when the old Secure Boot certificates expire, but it will leave your PC in a “degraded security state” that will be vulnerable to new exploits that are discovered in the future.
“It’s important to note that devices running unsupported versions (Windows 10 and older, excluding those who have enrolled in Extended Security Updates) do not receive Windows updates and will not receive the new certificates. We continue to encourage customers to always use a supported version of Windows for best performance and protection.”
Microsoft also says that over time, outdated Secure Boot certificates may lead to certain software, drivers, and newer Windows operating systems to fail to load. This isn’t expected to happen right away, but it will begin to take place as time progresses and new devices and software expect the latest Secure Boot certificates to function.
All the latest news, reviews, and guides for Windows and Xbox diehards.
The expiration of the original Secure Boot certificates has been planned since they were first introduced in 2011. “After more than 15 years of continuous service, the original Secure Boot certificates are reaching the end of their planned lifecycle and begin expiring in late June 2026.”
Microsoft says it’s working with its hardware partners and software vendors to ensure a smooth transition as millions of PCs move over to the new Secure Boot certificates. The company calls it “one of the largest coordinated security maintenance efforts across the Windows ecosystem, spanning Windows servicing, firmware updates, and millions of unique device configurations delivered by hardware manufacturers, or original equipment manufacturers (OEMs), worldwide.”
The good news is for those on older systems that are no longer supported by the latest version of Windows, you shouldn’t immediately see any changes in how your PC works and performs. Just like the end of support date for Windows 10, things should continue to function as you’d expect over the following months, but over time things will slowly stop supporting your device.
Are you concerned about these original Secure Boot certificates expiring? How might this impact older PCs that are no longer supported by Windows 11? Let us know your thoughts in the comments.
Join us on Reddit at r/WindowsCentral to share your insights and discuss our latest news, reviews, and more.
