In June 2025, Microsoft announced that, in June 2026, it would begin deprecating Secure Boot certificates of Windows systems from 2011, which were superseded by their 2023 counterparts.
As the clock counts down, it's time to do some housecleaning to prevent potential issues later this year. If you have a system managed by your company or school, your system administrators should be handling the process, which is different than for personal computers.
What are the certificates for?
Together, these four certificates verify that a system's initial boot processes -- the software loaded directly by the system even before Windows starts -- haven't been tampered with.
They're used by Secure Boot, a standard platform incorporated into the firmware of all modern Windows systems and enabled or disabled by the Unified Extensible Firmware Interface, which is enabled by default. A mismatch doesn't necessarily mean that malicious code is being loaded or executed -- just that the system can't rule it out.
When is this happening?
Certificates will begin expiring in June 2026 and continuing through October 2026.
Which versions of Windows does this apply to?
Generally, this will apply to all versions of Windows 10 1607 or later and Windows 11. (You can find detailed lists on Microsoft's site.) But to receive the certificate updates for Windows 10, you need to have enrolled in the Extended Security Updates program.
What do I need to do?
... continue reading