Secure Boot Certificates Expiring in June — Windows 10 Won’t Get a Fix

If you’re still running Windows 10 — or haven’t thought much about your PC’s security settings — there’s a deadline you need to know about. Starting June 2026, the Secure Boot certificates that have protected your PC’s startup process for over 15 years will begin to expire. Windows 11 users will receive a fix automatically. Windows 10 users almost certainly won’t.

This isn’t the kind of thing that will make your PC suddenly stop working. But it will quietly erode your protection against some of the most dangerous and hard-to-remove types of malware — the kind that attacks your PC before Windows even loads. Here’s what’s happening, who’s affected, and what you should do.

What Is Secure Boot and Why Do Certificates Matter?

Secure Boot is a security feature built into your PC’s firmware (UEFI) that checks whether the software loading at startup — before Windows even begins — is legitimate and has not been tampered with. Think of it as a bouncer at the door of your computer’s startup process.

At the heart of Secure Boot is a chain of digital certificates. These certificates act like ID badges, proving that each piece of boot software is signed and trusted by Microsoft. If anything in the boot chain lacks a valid signature, Secure Boot blocks it from running — stopping bootkits and rootkits before they can do damage.

The original set of certificates — the Microsoft KEK CA 2011 and Microsoft UEFI CA 2011 — were issued in 2011. After 15 years, they are reaching their end of life. Once they expire, your PC cannot use them to validate new boot updates and cannot apply new security mitigations to the boot process. You are effectively frozen in time.

The Certificates Are Expiring — Here’s the Timeline

The certificates that power Secure Boot were originally issued by Microsoft back in 2011 — and like all digital certificates, they have an expiry date. Three key certificates are now approaching that date:

Key Expiry Dates

Once these certificates expire, your PC won’t suddenly stop starting. But it will enter what Microsoft calls a “degraded security state” — meaning it can no longer receive new security protections for the early boot process. That includes updates to the Windows Boot Manager, new revocation lists (used to block known-bad software), and any future mitigations for newly discovered bootkit vulnerabilities.

Over time, that degraded state becomes increasingly dangerous. Every new boot-level vulnerability that gets discovered is one your machine can no longer be protected against.

Why Windows 10 Users Are Left Behind

This is the critical issue. Microsoft ended mainstream support for Windows 10 on October 14, 2025. Devices running unsupported versions of Windows do not receive Windows updates — which means they will never receive the new 2023 Secure Boot certificates through normal channels.

The only official path for Windows 10 users to receive the certificate update is to enrol in Microsoft’s Extended Security Updates (ESU) programme — a paid extension that was designed primarily for businesses needing more time before upgrading. For most home users, that is simply not a practical option.

The harder problem is hardware. Windows 11 introduced a mandatory TPM 2.0 requirement that locked out millions of otherwise functional PCs — machines too old for Windows 11 but still capable of running Windows 10. Those users now face a situation where their operating system is out of support and their boot-level security will stop receiving updates in June 2026.

If you are in this situation, we strongly recommend reading our guide on upgrading to Windows 11 and our breakdown of whether to repair or replace your laptop to help you weigh up the best path forward.

What Happens to Windows 11 Users?

For Windows 11 users, the news is much better. Microsoft has already begun rolling out the updated 2023 certificates through regular monthly Windows updates. For most people, no manual action is required — the update will arrive automatically.

However, there’s a catch for some devices. A small percentage of PCs may need a firmware update from their manufacturer before the new Secure Boot certificates can be applied. This is because the new certificates require the UEFI firmware to be updated to recognise them.

Starting in April 2026, Windows 11’s Windows Security app now displays a Secure Boot status badge:

• Green badge: You’re up to date. No action needed.
• Yellow badge: Action may be needed — usually a firmware update from your PC or motherboard manufacturer.
• Red badge: Your device cannot receive the update due to hardware or firmware limitations. Contact your manufacturer.

To check your status: open Windows Security → Device security → Secure Boot.

Who Is Affected — and Who Is Safe

Many Windows PCs manufactured since 2024 already include the updated 2023 certificates out of the box. If your machine is relatively new and fully up to date, you are almost certainly fine. The concern is the large installed base of older hardware — particularly pre-2020 machines — that may have missed updates or not yet received updated OEM firmware.

How to Check If Your PC Is Affected

Whether you’re on Windows 10 or Windows 11, here’s how to quickly assess your situation:

On Windows 11:

• Open Windows Security (search for it in the Start menu)
• Go to Device Security → Secure Boot
• Look at the badge — green means you’re fine, yellow or red means action is needed
• Also check: Settings → Windows Update → Advanced Options → Optional Updates for any available firmware updates

On Windows 10 (non-ESU):

• If your PC is running Windows 10 without Extended Security Updates, it will not receive the new certificates
• The most practical solution is to upgrade to Windows 11 if your hardware supports it
• If your hardware doesn’t support Windows 11, upgrading to a newer PC is worth considering — your machine is increasingly unprotected

What You Should Do — A Step-by-Step Action Plan

Here’s a practical breakdown of what different users should do before the June 2026 deadline:

The Bigger Picture: What This Means for PC Security

The Secure Boot certificate expiry is part of a broader security transition that Microsoft and PC manufacturers have been planning for years. The 2011 certificates served their purpose well — but cryptographic standards evolve, and 15-year-old certificates are no longer aligned with modern security expectations.

The real concern isn’t what happens on June 27, 2026 specifically. It’s what happens in the months and years after, as new boot-level vulnerabilities are discovered. A PC that can’t receive updated Secure Boot protections becomes progressively weaker against targeted attacks.

This is particularly relevant for business users and people who store sensitive data on their machines. BitLocker drive encryption and certain third-party security tools may also be affected by expired certificates over time.

Major manufacturers — Dell, HP, Lenovo, and ASUS — have been releasing firmware updates since 2023 to support the new certificates. But older devices (particularly pre-2020 models) may not receive manufacturer support at all, leaving them permanently unable to accept the new certificates regardless of Windows version.

Related Articles You May Find Helpful

If you’re thinking about next steps for your PC’s security and longevity, these guides cover the options in detail:

• How to Upgrade to Windows 11 — What You Need to Know
• Prepare for Windows 10 End of Support: What to Do Now
• Is Your Computer Ready for AI? (And Windows 11?)
• Laptop vs Desktop: Which Is Right for You?
• Should You Fix or Replace Your Laptop?
• PC Crashing After a Windows Update? Here’s What to Do
• Windows 11 24H2 Update Issues — Fixes and Workarounds
• Cybersecurity Mistakes That Could Cost Your Business

The Bottom Line

The June 2026 Secure Boot certificate expiry is a genuine security milestone — not a manufactured scare. After 15 years, the cryptographic foundations of your PC’s boot security are being refreshed, and whether your machine makes the transition cleanly depends almost entirely on which version of Windows you’re running.

If you’re on Windows 11: Check your status now, keep updates enabled, and install any available firmware updates. You’ll likely be fine.

If you’re on Windows 10: The clock is ticking. Every month you stay on an unsupported Windows version is a month your machine falls further behind — and after June, that includes Secure Boot protection. Upgrading to Windows 11, or to a new PC, is the right move.

Not sure where to start? We’re here to help — whether that’s a quick assessment, a Windows 11 upgrade, or advice on what to replace your current machine with.

Frequently Asked Questions

Key Takeaways

• Microsoft’s original 2011 Secure Boot certificates begin expiring on June 24, 2026.
• Windows 11 users will receive the updated 2023 certificates automatically via Windows Update.
• Windows 10 users without Extended Security Updates will NOT receive the new certificates — leaving them unable to get future boot-level security updates.
• Your PC will not refuse to boot on expiry day, but its defences against boot-level malware will stop advancing from that point.
• Check your status now in Windows Security → Device security → Secure Boot. Green is good; yellow or red requires action.
• Install your PC manufacturer’s latest firmware update — this is often a required prerequisite before Windows can apply the new certificates.
• If you are on Windows 10 with incompatible hardware, start planning your upgrade path now — not after the deadline.

Useful links:

• Windows 11 Upgrade Service
• Computer Upgrades
• Cybersecurity Solutions
• Managed IT Services
• Remote IT Support
• Virus & Malware Removal