Windows Secure Boot Certificate Expiry: Is Your PC Ready for the 2026 Deadline?
If you use a Windows PC, a critical security deadline is approaching that could impact your system’s ability to boot safely. Microsoft has confirmed that Secure Boot certificates issued in 2011 are set to expire in June 2026. While many modern devices are already protected, millions of older PCs—particularly those running unsupported versions of Windows 10—may face significant stability and security risks if they aren’t updated.
- The Issue: Secure Boot certificates from 2011 expire in June 2026.
- The Fix: Install the updated 2023 certificates via Windows Update.
- Who is at Risk: Users with older hardware and those on unsupported Windows 10 installations.
- Action Required: Check the Windows Security app to verify your update status.
What is Secure Boot and Why Does it Matter?
Secure Boot is a security standard developed by members of the PC industry to help ensure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM). When your PC starts, the firmware checks the signature of each piece of boot software, including UEFI firmware drivers, EFI applications, and the operating system.
By verifying these signatures against a database of trusted certificates, Secure Boot prevents “bootkits” or rootkits—malicious software that loads before the operating system—from hijacking your computer. If the certificate used to sign the bootloader expires or is revoked, the system may view the software as untrusted, which can lead to boot failures or security vulnerabilities.
The 2026 Expiration: What’s Happening?
The certificates that have underpinned the security of millions of Windows devices since 2011 are reaching their end-of-life. To maintain the “root of trust,” Microsoft is transitioning devices to updated 2023 certificates.
For the vast majority of users, this transition is invisible. Microsoft is delivering these updated certificates automatically through Windows Update to consumer and business devices. However, the process isn’t automatic for everyone, and the June 2026 deadline creates a hard stop for those who haven’t updated.
Who is Affected?
Whether you need to take action depends largely on the age of your hardware and your current software support status:
- Newer PCs: If your computer shipped within the last two years, it likely already includes the 2023 certificates and requires no action.
- Supported Windows 10/11 PCs: If you keep your system updated, the certificates are likely already installed in the background.
- Unsupported Windows 10 PCs: This is the high-risk group. Hundreds of millions of Windows 10 devices that have fallen off official support will not receive these automatic updates. These users are at risk of falling foul of the certificate expiration.
The Windows 10 Support Gap
Because the updated certificates are delivered via Windows Update, devices that are no longer receiving updates are effectively stranded. For these users, the only way to maintain security and boot stability is to either upgrade to Windows 11 (if the hardware allows) or enroll in the Extended Security Updates (ESU) program to continue receiving critical patches.
How to Check if Your PC is Ready
You don’t have to guess whether your system is updated. Microsoft has integrated a check directly into the operating system.
- Open the Windows Security app.
- Navigate to the Device Security section.
- Look for the Secure Boot status.
- The app will indicate whether your device has received the necessary updates and if any further action is required.
If the app indicates you are not up to date, immediately run Windows Update to check for available security patches and firmware updates.
Frequently Asked Questions
Will my computer stop working in June 2026?
Not necessarily, but it may become vulnerable or fail to boot if the firmware strictly enforces the expired 2011 certificates. The goal is to have the 2023 certificates in place before the deadline to ensure a seamless transition.
What happens if I ignore the update?
Ignoring the update could leave your system open to boot-level malware that Secure Boot would otherwise block. In some cases, it could lead to “Secure Boot Violation” errors during startup, preventing the OS from loading entirely.
Can I manually install the certificates?
For most users, the certificates are bundled into wider software downloads and UEFI updates provided by the manufacturer. Check your PC manufacturer’s support page for the latest BIOS/UEFI updates if Windows Update isn’t providing the fix.
Final Thoughts: Don’t Wait Until June
Cybersecurity is often a race against the clock, and the Secure Boot expiration is a prime example. While it may seem like a minor technical detail, the “root of trust” is the foundation of your PC’s entire security architecture. If you are running an older machine or a version of Windows 10 that is no longer supported, now is the time to plan your upgrade or secure an ESU license. Verify your status in the Windows Security app today to ensure your system remains protected through 2026 and beyond.