Microsoft Secure Boot Certificate Refresh Ahead of 2011 Certificate Expiration

Microsoft has started deploying updated Secure Boot certificates via regular monthly Windows updates to replace the original 2011-era certificates that begin expiring in late June 2026. Secure Boot, introduced in 2011 for UEFI-based systems, helps prevent pre-OS malware (e.g., bootkits/rootkits) by allowing only trusted, properly signed boot components to load, using a certificate chain anchored in UEFI firmware and validated against trusted signature databases.

The expiring components include Microsoft-issued certificates used in the Secure Boot trust chain (including the Key Exchange Key (KEK) and Microsoft UEFI CA/Production CA certificates), which are present on most PCs built since 2011 and also affect many Linux distributions that rely on Microsoft’s UEFI signing ecosystem. Microsoft says the refresh will be automatic for in-support Windows devices where updates are Microsoft-managed, while organizations can also control deployment through their own management tooling; the effort is positioned as a large-scale ecosystem maintenance activity involving coordination across many OEM firmware configurations.