Windows devices for home users, businesses, and schools with Microsoft-managed updates

What’s happening?

To help keep your Windows device secure, Microsoft is updating the certificates used by Secure Boot—a security feature that helps protect your devices from malware during startup. These certificates, originally issued in 2011, are set to expire starting in June 2026. To stay protected, your operating system (OS) needs to receive a new set of certificates before then. 

Why does this matter? 

Secure Boot helps ensure that your device only runs trusted software when it starts up. If the Secure Boot certificates expire, your device could become vulnerable to security threats. 

That is why Microsoft is rolling out new certificates now, well ahead of the June 2026 expiration date. 

Is this applicable for my Windows device? 

If you use a Windows 10 or Windows 11 device that runs Home, Pro or Education edition, and you get updates automatically from Microsoft (like most people do), then yes—this is applicable for your device. 

The good news is that the new 2023 certificates will be delivered to your device through regular Windows Update channels. For most users, no action is needed. 

When is this happening? 

The new certificate updates will continue gradually through June 2026. Microsoft is starting with Home and Pro edition systems first to ensure a smooth and safe transition. 

Where can I learn more about Secure Boot and the certificate update? 

See the article Secure boot to learn more about its technical details. To stay up to date on the certificate update rollout, check the release notes for Windows updates available on the Windows 11, version 24H2 update history and Windows 10 update history pages. 

What do I need to do? 

In most cases, nothing! Just make sure that: 

• Your device is running a supported version of Windows 10 or Windows 11.

• Windows updates are not paused.

• Secure Boot is enabled (it usually is by default on newer systems).

To check if Secure Boot is turned on: 

1. Press Windows + R, type msinfo32, and then press Enter.

2. In the System Information window, look for Secure Boot State.

3. If it says On, you’re good to go!

If Secure Boot is currently disabled, please consult your device manufacturer for information about when your device firmware will be updated to include the latest Secure Boot configuration from Microsoft. We recommend checking this before making any changes to your Secure Boot settings. For more information, please see Windows 11 and Secure Boot. 

Troubleshooting

Unfortunately, in a few cases, your device might not start, or you might experience a BitLocker recovery situation when receiving the new certificates. We can help you recover from these situations.

• If your device will not start after receiving the new certificates, you might need to disable Secure Boot. To do this, see the Disabling Secure Boot section.

• If you encounter a BitLocker recovery situation after receiving the new certificates, see the BitLocker recovery section.