Microsoft Windows Secure Boot Update: What You Need to Do Before June 2026

Microsoft is updating Windows Secure Boot certificates before they begin expiring in June 2026. Most supported Windows PCs will receive the update automatically, but users should check Windows Update, Secure Boot status, BIOS/UEFI firmware, and BitLocker recovery key access to avoid future security issues.

Microsoft is rolling out an important Windows Secure Boot update before older Secure Boot certificates begin expiring in 2026. For most home users on supported Windows devices, the update should arrive automatically through Windows Update. But if your PC is older, managed by an organisation, running Windows 10 without Extended Security Updates, or has outdated BIOS/UEFI firmware, you may need to check your device before June 2026.

Secure Boot is the Windows security feature that helps ensure your PC starts using trusted software only. Microsoft says Secure Boot certificates originally issued in 2011 begin expiring in June 2026, and devices need newer 2023 certificates to keep receiving future boot-level security protections.

What is the Microsoft Windows Secure Boot update?

The Microsoft Windows Secure Boot update replaces ageing 2011 Secure Boot certificates with newer 2023 certificates. These certificates are stored in your device's firmware and help Windows verify trusted boot components before the operating system loads.

In simple terms, Secure Boot checks whether early startup software, such as bootloaders and firmware components, can be trusted. Microsoft explains that Secure Boot uses UEFI firmware and digital certificates to verify pre-boot software before Windows starts.

This update matters because Microsoft’s original Secure Boot certificates are reaching the end of their planned lifecycle. The Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011 begin expiring in June 2026, while the Microsoft Windows Production PCA 2011 expires in October 2026.

If you are still using Windows 10, it is worth reviewing the key steps Windows 10 users should take to stay safe before relying on future security updates.

Quick answer: do you need to do anything?

For most supported Windows 10 and Windows 11 Home, Pro, or Education devices that receive updates directly from Microsoft, no manual Secure Boot fix is usually required. Microsoft says the new 2023 certificates are being delivered through regular Windows Update channels, and for most users supported Windows systems, no action is needed.

However, you should still check three things:

1. Your PC is running a supported version of Windows.
2. Windows Update is not paused.
3. Secure Boot is enabled in BIOS/UEFI settings.

Microsoft notes that Windows 10 support ended on October 14, 2025, and users who want to continue receiving security updates, including Secure Boot updates, need the Windows 10 Extended Security Updates programme.

Why the Secure Boot update matters

Secure Boot protects your PC before Windows fully starts. That early boot stage is a valuable target for bootkits and other low-level malware because attacks at this level can load before normal antivirus or endpoint tools.

If your device does not receive the new Secure Boot certificates, Microsoft says the PC may still start, and standard Windows updates may continue to install. The risk is that the device may no longer receive future security protections for early boot components, including Windows Boot Manager updates, Secure Boot database updates, revocation lists, and mitigations for new boot-level vulnerabilities.

That means the issue is not simply “will my PC turn on after June 2026?” In many cases, it will be. The bigger concern is that the device can move into a weaker security position over time.

What happens if you ignore the Secure Boot certificate update?

If your PC reaches the certificate expiration date without the 2023 certificates, Microsoft says it should still start and operate normally, and everyday app use, browsing, networking, and most Windows features should remain unchanged.

The problem is security. Devices that remain on expired Secure Boot certificates may not receive future protections for the early boot process. Microsoft specifically mentions Windows Boot Manager protections, Secure Boot database and revocation updates, and fixes for boot-chain vulnerabilities.

In higher-risk environments, Microsoft warns that outdated firmware or failed certificate updates may lead to Secure Boot validation errors; BitLocker recovery prompts, startup hangs, or devices failing to boot.

How to check if Secure Boot is enabled

Use this quick Windows update guide to check your Secure Boot status:

1. Press Windows + R.
2. Type msinfo32 and press Enter.
3. In System Information, look for Secure Boot State.
4. If it says On, Secure Boot is enabled.

Microsoft gives the same msinfo32 method for checking Secure Boot State and says that if it shows “On,” you are good to go for Secure Boot being enabled.

You can also check in the Windows Security app:

Windows Security > Device security > Secure Boot

Starting in April 2026, Microsoft says the Windows Security app displays additional Secure Boot certificate update status information under Device security > Secure Boot. The app may show green, yellow, or red indicators depending on your device’s status.

A green check alone does not always prove the certificates are updated. Microsoft says to look for the message: “Secure Boot is on, and all required certificate updates have been applied. No further certificate changes are needed.”

As more users rethink their tech upgrades in 2026, upcoming devices like the iPhone Ultra show how security, performance, and long-term software support are becoming major buying factors.

What you should do before June 2026

1. Install all available Windows updates

Go to:

Settings > Windows Update > Check for updates

Install every available update, then restart your PC if prompted. If another update appears after rebooting, install it too. Microsoft says supported personal Windows devices are expected to receive the new certificates through regular Windows Update channels.

2. Make sure Windows Update is not paused

The Secure Boot update depends on your system receiving current Windows updates. Microsoft’s guidance for home users specifically says Windows updates should not be paused.

3. Check whether your Windows version is still supported

This is especially important for Windows 10 users. Windows 10 support ended on October 14, 2025, and Microsoft says users need Windows 10 Extended Security Updates to continue receiving security updates, including Secure Boot-related updates.

For many users, the practical options are:

• Upgrade to Windows 11 if the device meets Secure Boot requirements and other Windows 11 hardware requirements.
• Use Windows 10 ESU if eligible.
• Replace unsupported hardware if it cannot be updated safely.

4. Update your BIOS or UEFI firmware

Secure Boot certificates live in firmware, so BIOS/UEFI compatibility matters. Microsoft recommends checking for and deploying OEM firmware updates, especially on older device models, because firmware updates can improve compatibility and reduce update failures.

For personal PCs, visit your manufacturer’s support site, such as Dell, HP, Lenovo, ASUS, Acer, Microsoft Surface, or your motherboard vendor. Look for BIOS, UEFI, firmware, or security updates for your exact model.

5. Do not disable Secure Boot as a workaround

Disabling Secure Boot may look like a quick Secure Boot fix, but it weakens protection. Microsoft explicitly warns that Secure Boot should not be disabled to work around certificate expiration because doing so reduces device protection and can create new security and compliance risks.

Only disable Secure Boot temporarily if you are following official recovery steps after a boot failure or under guidance from your device manufacturer or IT team.

6. Back up your BitLocker recovery key

Secure Boot, TPM security, and BitLocker often work together as part of Windows device protection. Microsoft says some users may encounter a BitLocker recovery situation after receiving new certificates, and in that case, they need the 48-digit BitLocker recovery key.

7. Contact your device manufacturer if Windows shows a warning

If Windows Security says your device does not support the automated Secure Boot certificate update due to hardware or firmware limitations, Microsoft says to contact your device manufacturer for assistance.

What IT teams should do

For businesses, schools, and organisations, the Microsoft Secure Boot changes require more planning. Microsoft’s IT guidance recommends preparing, monitoring, deploying to small groups first, and remediating issues before broad rollout.

IT teams should:

• Inventory hardware models, BIOS versions, firmware dates, baseboard versions, and Secure Boot status.
• Test representative devices before fleet-wide deployment.
• Apply OEM BIOS/UEFI updates where needed.
• Monitor registry keys and event logs.
• Use Intune, Group Policy, registry keys, or Windows configuration tools for managed deployment.

Microsoft says IT-managed environments can deploy and monitor Secure Boot certificate updates using registry keys, Group Policy, Windows Configuration Service Provider/Windows Configuration System, or Microsoft Intune.

For Group Policy, Microsoft lists the policy path as:

Computer Configuration > Administrative Templates > Windows Components > Secure Boot

For Microsoft Intune, Microsoft says admins can use the Settings Catalog and search for Secure Boot settings, including certificate update deployment settings.

Windows Server also needs special attention. Microsoft says Windows Server instances do not receive the 2023 Secure Boot certificates through Controlled Feature Rollout in the same way Windows PCs do, so administrators must take action on in-scope servers with Secure Boot enabled.

Secure Boot requirements: what your PC needs

For this update to work smoothly, your device should have:

• UEFI firmware with Secure Boot support.
• Secure Boot enabled.
• A supported Windows version.
• Current Windows updates.
• Compatible OEM BIOS/UEFI firmware.
• TPM security available where features such as BitLocker rely on it.

Most devices manufactured since 2012 support Secure Boot and ship with Secure Boot enabled, according to Microsoft’s IT guidance.

A simple Secure Boot fix checklist

Use this checklist before June 2026:

• Open Settings > Windows Update and install all updates.
• Restart your PC after updates.
• Run msinfo32 and confirm Secure Boot State: On.
• Open Windows Security > Device security > Secure Boot and check certificate status.
• Update your BIOS/UEFI firmware from your device manufacturer.
• Save your BitLocker recovery key before firmware changes.
• Do not disable Secure Boot unless instructed for recovery.
• If you are on Windows 10, confirm ESU coverage or plan a Windows 11 upgrade.

 

 

Final takeaway

The Windows Secure Boot update is not something to ignore until the last minute. Microsoft is replacing old 2011 Secure Boot certificates with 2023 certificates before expiration begins in June 2026. For most supported home users, Windows Update should handle it automatically. For older PCs, Windows 10 systems, business devices, servers, and machines with outdated firmware, now is the time to check Secure Boot status, update BIOS/UEFI firmware, and confirm your device can keep receiving boot-level Windows security updates.

 

FAQ

What is the Windows Secure Boot update?

The Windows Secure Boot update is Microsoft’s rollout of newer 2023 Secure Boot certificates to replace certificates originally issued in 2011. The update helps Windows continue validating trusted boot software and receiving future boot-level security protections.

When do Microsoft Secure Boot certificates expire?

Some Microsoft Secure Boot certificates begin expiring in June 2026. Another key Windows Production PCA 2011 certificate expires in October 2026.

Will my PC stop working after June 2026?

Usually, no. Microsoft says devices without the new certificates may still start normally and receive standard Windows updates, but they may not receive future protections for early boot components.

Do Windows 11 users need to do anything?

Most supported Windows 11 users should receive the update automatically through Windows Update. Still, it is worth checking that Windows Update is not paused, Secure Boot is enabled, and the Windows Security app shows that certificate updates have been applied.

What about Windows 10 users?

Windows 10 support ended on October 14, 2025. Microsoft says Windows 10 users need Extended Security Updates to continue receiving security updates, including Secure Boot updates.

Should I change BIOS settings?

You should check that Secure Boot is enabled, but avoid making random BIOS settings changes. If Secure Boot is off or Windows reports a firmware limitation, check your manufacturer’s firmware guidance first.

Is this the same as TPM security?

No. Secure Boot and TPM are different technologies, but they often work together in Windows security. Secure Boot validates trusted startup components, while TPM security supports features such as encryption key protection and BitLocker.

What is the safest Secure Boot fix?

The safest Secure Boot fix is to keep Windows updated, install OEM BIOS/UEFI firmware updates, confirm Secure Boot is enabled, and check the Windows Security app for certificate update status. Do not disable Secure Boot to bypass the issue.