Microsoft rolls out new Secure Boot certificates before June expiration

Microsoft is replacing its 2011 UEFI Secure Boot certificates via monthly Windows updates ahead of their June 2026 expiration, ensuring continued boot-time protections across supported Windows devices. Many newer PCs already include the updated certificates, but some systems may require OEM firmware updates; Microsoft will auto-update high-confidence devices while offering admins deployment options via Group Policy, registry, and WinCS. Devices that miss the update will enter a degraded security state, and unsupported Windows versions (e.g., Windows 10 without ESU) will not receive the new certificates.