FAQs about the expiration of Windows Secure Boot certificates

[#1]

FAQs about the expiration of Windows Secure Boot certificates

Microsoft is replacing the Secure Boot certificates (CAs) used in many Windows systems since 2011 because they will gradually expire starting in June 2026 (others by October 2026 at the latest). To ensure that Secure Boot continues to receive updates and can trust new boot components, affected devices must be migrated to 2023 certificates.

• What is Secure Boot?

• Secure Boot ensures that only signed and trusted software is executed during system startup. If the certificate expires and no update is available, systems may:
  • no longer boot
  • block certain operating systems, boot loaders, or drivers.

• Which systems are affected?

• Potentially affected are:
  • Windows systems (Windows 10, Windows 11, and server versions)
  • Linux distributions and other operating systems that use Secure Boot
  • Devices whose firmware (UEFI) is not updated

• What is Microsoft changing?

• Microsoft provides new secure boot certificates (new UEFI CA) and distributes them via:
  • Windows Updates
  • Firmware / UEFI updates from device manufacturers (OEMs)

  The old and new certificates will run in parallel for a period of time to ensure a smooth transition.

  ⚠️Note⚠️ A BIOS / firmware update for your notebook may not be absolutely necessary. And if it is, the corresponding update will be received automatically via Windows Update by then.

• What is recommended for the end user?

• The update process is largely automatic, but make sure,
  • that Secure Boot is enabled.
  • that you are using one of the supported Windows operating systems in the latest version.
  • that you have enabled the installation of Windows updates in the system settings.

---

The information in this article refers to:

• Devices with Windows operating system

ChangeLog:

• 2026-02-09
  Initial version

Article in other languages:

• Deutsch

Review Date: 2026-05-09