Microsoft started the automatic replacement of the original Secure Boot security certificates on Windows devices through regular monthly updates, a necessary move as the old certificates first issued in 2011 will expire between June and October 2026.
Secure Boot, which verifies that only trusted and digitally signed software can run before Windows loads, became a hardware requirement for Windows 11.
A new batch of certificates was issued in 2023 and is already available on most computers manufactured since 2024.
Almost all devices released in 2025 include these certificates by default.
Older hardware is now receiving the updated certificates via Windows Update, starting with last month's KB5074109 release for Windows 11. Devices that don't receive the new certificates before the old ones expire will still work, but they will enter what Microsoft calls a "compromised security state," won't be able to receive future boot-level protections, and may experience compatibility issues in the future.
Windows 10 users will need to enroll in Microsoft's paid Extended Security Updates program to receive the new certificates.
A small number of devices may also require a separate firmware update from their manufacturer before the certificates provided by Microsoft can be applied.
Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.
