Microsoft just issued a Secure Boot warning for 2026 — here’s what it means for Windows security

After 15 years, the original Secure Boot certificates that keep your PC secure during boot are expiring. Here's what you need to know.

Microsoft has announced that the original Secure Boot certificates that were issued when the feature first began shipping 2011 are set to expire this June, and that PCs which are not up to date will enter a degraded security state when this happens. This is the first time since Secure Boot was introduced that its certificates are expiring.

Secure Boot is a security feature that ships as part of Windows PCs, and is on by default. It protects your PC from certain security vulnerabilities that could be exploited during the boot phase, before Windows even fully loads, and ensures only signed code can run during this phase.

Pretty much all PCs that have shipped since 2011 include Secure Boot, and so most Windows users are going to be impacted by these Secure Boot certificates expiring. Microsoft says that most PCs will automatically be updated with new Secure Boot certificates via Windows Update, but that some PCs will need an additional firmware update issued by their OEM too.

Most PCs that have shipped since 2024 already have these updated Secure Boot certificates, and so there's nothing you need to worry about if you're using a Windows PC that shipped in the last couple of years.

If you're using an older PC that's running a version of Windows that's no longer supported, you will not receive updated Secure Boot certificates. Microsoft says that functionally, nothing will immediately change when the old Secure Boot certificates expire, but it will leave your PC in a "degraded security state" that will be vulnerable to new exploits that are discovered in the future.

"It’s important to note that devices running unsupported versions (Windows 10 and older, excluding those who have enrolled in Extended Security Updates) do not receive Windows updates and will not receive the new certificates. We continue to encourage customers to always use a supported version of Windows for best performance and protection."

Microsoft also says that over time, outdated Secure Boot certificates may lead to certain software, drivers, and newer Windows operating systems to fail to load. This isn't expected to happen right away, but it will begin to take place as time progresses and new devices and software expect the latest Secure Boot certificates to function.