Microsoft has begun rolling out Windows updates that automatically replace expiring Secure Boot certificates on supported Windows 11 (versions 24H2 and 25H2) systems. This is part of a planned transition because the current certificates — originally issued in 2011 — are nearing their expiration beginning June 2026.
Secure Boot is a key UEFI firmware security feature that helps ensure only trusted, signed boot software runs when a PC starts up. If the certificates used to validate that code expire without replacement, devices won’t be able to receive future Secure Boot security updates and may be unable to enforce trust for boot loaders.
Why the update matters
- Certificate expiration timeline: The old Microsoft Secure Boot certificates, such as Microsoft Corporation KEK CA 2011, UEFI CA 2011 and others, begin expiring June 2026 and continue through October 2026.
- Impact: Without updated certificates, systems might continue to boot but will not receive critical pre-boot security updates and could lose Secure Boot protections — leaving them more vulnerable to low-level malware and integrity attacks.
How the new updates are being deployed
Microsoft’s approach to rolling out new certificates includes:
- Automatic, phased deployment — Windows Update will install the new certificates on devices that qualify (“high confidence” in update readiness) rather than forcing them all at once.
- Devices only receive updates once they’ve shown they can successfully update safely, which helps avoid problems on older or unusual hardware.
What IT admins and users should do
- Keep Windows Update enabled and current: Staying up-to-date ensures the new Secure Boot certificates are installed automatically.
- Check devices proactively: Especially in enterprise environments, verify which machines have updated Secure Boot certificates and which need attention using tools like registry checks or management policies.
- OEM firmware updates may be required: Some devices may need updated UEFI firmware from the manufacturer before Secure Boot certificate updates can be fully applied.
- Advanced management options: Organizations can also push certificates via Group Policy, the Windows Configuration System (WinCS), or registry keys for tighter control.
Why this isn’t just routine
This transition marks one of the largest Secure Boot certificate updates in years because these certificates form the foundation of trusted boot security on Windows platforms. Microsoft has been warning admins for months about the impending certificate expiry and possible impact if updates aren’t applied in time.
