Millions of Windows personal computers could face significant security risks or even boot failures starting in late June 2026. This comes as Microsoft's original 2011 Secure Boot certificates, which are crucial for system startup security, begin to expire. Users must ensure their devices receive new 2023 certificates to maintain protection and functionality.^[1][2][3] ### Understanding Secure Boot and Expiring Certificates Secure Boot is a fundamental security feature within a PC's Unified Extensible Firmware Interface (UEFI) firmware. It ensures that only trusted, digitally signed software can load during the computer's startup process, preventing malicious programs like rootkits from executing before Windows even begins.^[2][4][5][6] This system relies on cryptographic certificates, acting as digital IDs, to verify the authenticity of boot components.^[7][4] The certificates that are now reaching their end of life were first introduced in 2011 with Windows 8.^[8][6] They have served for over 15 years.^[5][6] The first set of these 2011 certificates, specifically the Microsoft Corporation KEK CA 2011, will expire on June 24, 2026.^[1] This will be quickly followed by the Microsoft Corporation UEFI CA 2011 expiring on June 27, 2026.^[1] Another key certificate, the Microsoft Windows Production PCA 2011, will expire later on October 19, 2026.^[1] ### The Looming Security Risk While many devices are expected to continue booting, PCs that do not transition to the newer 2023 certificate chain will enter a "degraded security state."^[1][3][5] This means they will lose the ability to receive future bootloader and Secure Boot updates.^[1][3] This vulnerability leaves systems exposed to new boot-level threats, such as sophisticated bootkit malware, which can be difficult for standard antivirus software to detect.^[3][9] In some cases, if a future firmware or security update relies on a newer Secure Boot certificate that the PC lacks, the device may fail to start entirely.^[4] Users might also encounter issues with BitLocker recovery, making it vital to back up recovery keys before any firmware changes.^[1] Microsoft has explicitly stated that disabling Secure Boot is not a recommended solution, as it significantly reduces device protection.^[3] ### Steps to Update Your PC Microsoft has been proactively rolling out the necessary 2023 Secure Boot certificates through regular monthly Windows updates. These updates have been included in Windows builds released on and after February 13, 2024.^[1] The company expects most personal Windows devices to receive these new certificates automatically.^[1][6] However, some PCs may require an additional step: an update to their Unified Extensible Firmware Interface (UEFI) firmware, often referred to as a BIOS update.^[1][7][5][6] These firmware updates are provided by the PC's original equipment manufacturer (OEM).^[1][4] Users should check with their PC manufacturer for the latest BIOS/UEFI updates to ensure their system is prepared to accept the new certificates.^[7] To check if Secure Boot is enabled on your system, you can use the Windows System Information tool.^[4] PCs manufactured since 2024, and nearly all devices shipped in 2025, already include the updated certificates and generally require no customer action.^[2][7][8][6] Devices running unsupported Windows versions, such as Windows 10 without an active Extended Security Updates (ESU) program enrollment, will not receive the new certificates, further increasing their security risk.^[5][8] ### An Industry-Wide Security Initiative This certificate refresh represents one of the largest coordinated security maintenance efforts across the Windows ecosystem.^[2][5][6] Microsoft is working closely with numerous hardware manufacturers and OEMs to ensure a smooth transition across millions of diverse device configurations.^[2][5][6] It is important to note that this Secure Boot certificate expiration is distinct from a separate boot issue affecting some commercial Windows 11 devices in early 2026. That problem, related to the January 2026 security update (KB5074109) and later updates, caused devices to fail booting with an "UNMOUNTABLE_BOOT_VOLUME" error, but Microsoft states this has been resolved in the February 2026 Patch Tuesday update (KB5077181).^{[10][11][12][13]} The Secure Boot certificate expiration is a planned, long-term security update.^[14] Ensuring your Windows PC is up to date with the latest Secure Boot certificates and any necessary OEM firmware updates is critical to maintaining robust security and preventing potential boot issues beyond June 2026.^[3][9]

AI Insights Hub