Microsoft announced that the original Secure Boot certificates, issued in 2011, will begin to expire in June 2026. Esse security feature verifies the integrity of the software during computer startup and prevents untrusted code from running. Dispositivos that do not receive the new 2023 certificates before the deadline will continue to boot and function normally, but will lose the ability to obtain future updates for the initial boot process.
Secure Boot is present on virtually all PCs manufactured since 2011 with Windows 10 or 11 pre-installed. Ele acts as a trust mechanism based on digital certificates stored in the UEFI firmware. Expiration primarily affects the Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011 certificates in June, with the Microsoft Windows Production PCA 2011 following in October 2026.
What happens after old certificates expire
Affected computers maintain basic functionality without immediate interruptions. Atualizações default of Windows continue to be installed normally. However, specific protections against threats at the initial boot stage are no longer updated.
This includes fixes for vulnerabilities in the boot chain and updates to the authorized and revoked signature lists. Microsoft describes the process as one of the largest coordinated security maintenance operations in the Windows ecosystem.
Updates already underway by Microsoft and manufacturers
The company has begun distributing the new 2023 certificates through monthly Windows updates. Dispositivos with supported Windows receive these changes automatically in many cases. Fabricantes hardware manufacturers (OEMs) release supplemental firmware updates to ensure full compatibility.
PCs produced from 2024 onwards generally already include the updated certificates in the firmware. Para older models, the combination of Windows and manufacturer updates resolves the issue in most situations.
How to check and apply necessary updates
Users can check the status of certificates through PowerShell commands or registry editor checks. Microsoft has provided detailed guides for monitoring and deployment in home and corporate environments.
In business scenarios, IT administrators manage the process with their own tools. The recommendation is to install updates as soon as possible to avoid a degraded security status after June 2026.
Impact on features dependent on Secure Boot
Features such as BitLocker improvements and code integrity at boot depend on the chain of trust being intact. Bootloaders Third-party and optional components may also be affected if they require trust updates.
Disabling Secure Boot is a possible alternative, but requires recovery key for BitLocker encrypted disks. Microsoft reinforces that keeping the resource active is essential to protect against rootkits and malware at boot.
Recommended preparation for users and companies
Install all pending updates for Windows regularly. Verifique whether the PC manufacturer offers recent firmware updates. Monitore official communications from Microsoft on the topic for specific guidance.
The transition represents a planned renewal of the root of trust after more than 15 years. Novos certificates have extended validity until 2038 and strengthen the overall security of the system.
