Microsoft Updates Secure Boot Certificates for 2026 Expiration

Microsoft announced plans this week to update Secure Boot certificates on Windows devices, as the original certificates issued in 2011 approach expiration in June 2026. The change affects millions of personal computers and servers worldwide that rely on the feature to verify trusted software during startup, potentially leaving unupdated systems vulnerable to boot-level threats if not addressed.

Secure Boot, introduced with Windows 8 more than a decade ago, prevents malicious code from loading before the operating system starts by checking digital signatures against stored certificates in the device's firmware. The current certificates, known as Microsoft Windows Production PCA 2011 and Microsoft UEFI CA 2011, have ensured this protection since then but must now be replaced to align with modern security standards. Without the refresh, systems will continue to boot and function normally after expiration, but they will lose the ability to apply new boot-level security mitigations, according to Microsoft. This could expose devices to emerging vulnerabilities and cause compatibility issues with future operating systems, hardware, or software that depends on Secure Boot.