Help maintain Secure Boot certificate updates

Certificates issued in 2011 expire starting in June 2026. Monitor your device status and take action as needed.

Impacted audience

All partners

Secure Boot certificates issued in 2011 expire in June and October of 2026. In order for Secure Boot to continue operating as designed on Windows devices, Microsoft is updating these certificates.

Many Windows devices receive the updated certificates automatically, depending on configuration and support status, and many device manufacturers provide firmware updates when needed. By keeping your device current with these updates, you can continue to benefit from the security protections that Secure Boot is designed to provide.

If the device is running in-support versions of Windows, certificate updates are available from Microsoft. Monitor your device status and take action as needed. For information on Windows 11, Windows 10, and Windows Server versions and editions in support, use the Search Product and Services Lifecycle Information site.

Deploying certificates for customers with managed updates

Organizations with managed updates can deploy certificates on client and server devices using Microsoft Intune (recommended), registry keys, Windows Configuration System, or Group Policy. You'll also need to install the new certificates on Windows Servers and on some customer devices that don’t automatically receive the updated certificates.

More Secure Boot certificate check capabilities are planned for future release.

Next steps

• Review guidance on keeping Secure Boot certificates up to date.
• Access more scripts and deeper guidance for IT admins.
• Monitor your device status and review your customer environments.