Microsoft Will Use Windows Updates to Keep Secure Boot Working as Certificates Expire

Microsoft will use standard Windows 11 updates to keep Secure Boot working on existing PCs as the operating system’s original certificates near their end. The company says Secure Boot certificates issued in 2011 will expire between June and October 2026, so Windows 11 updates will also include a replacement certificate chain and new Windows Boot Manager binaries for eligible systems, The Verge reports.
Secure Boot helps keep your computer safe by using trusted certificates in UEFI firmware. It checks bootloaders and prevents dangerous applications from running before Windows starts. Through Secure Boot-enabled Windows 11 updates, Microsoft will target “high‑confidence” devices (PCs that regularly install Windows updates successfully) with a strong update history and let them switch to the newer trust chain ahead of the deadline. Basically, Microsoft will choose these PCs first for the new Secure Boot certificate rollout.
Newer PCs sold from 2024 already ship with the newer 2023 Secure Boot certificate, but older hardware depends on these updates to stay fully protected.
Microsoft says that if a PC doesn’t receive the new certificates in time, it will still boot, but it will enter a lower security mode. This means it will have limited protection against new vulnerabilities that may arise before it starts up. The company warns that missing the rotation could weaken protections against exploits that target early boot code.
Microsoft urges IT admins to install current Windows updates, refresh deployment images and recovery media, and follow its Secure Boot playbook to coordinate firmware and OS‑level certificate changes before expirations begin. Home users are advised to keep Windows Update turned on without disabling Secure Boot.
© 2001-2026 Ziff Davis, LLC., a Ziff Davis company. All Rights Reserved.
ExtremeTech is a federally registered trademark of Ziff Davis, LLC and may not be used by third parties without explicit permission. The display of third-party trademarks and trade names on this site does not necessarily indicate any affiliation or the endorsement of ExtremeTech. If you click an affiliate link and buy a product or service, we may be paid a fee by that merchant.

source