Microsoft is keeping Secure Boot alive with Windows updates

2026-02-10 · Source: The Verge · Field: Technology & Digital — Cybersecurity & Data Privacy, Software Development & Engineering, Internet of Things (IoT) & Connected Devices · Depth: Fundamental Awareness, quick

Summary

Microsoft is automatically updating Secure Boot certificates on Windows devices to prevent expiration later this year, a "generational refresh" of the security standard. Introduced in 2011, Secure Boot protects systems from unauthorized boot-time changes and is a Windows 11 hardware requirement. The original 2011 certificates are set to expire between June and October 2026. While new devices sold since 2024 already ship with 2023 certificates, older PCs require updates. Microsoft emphasizes that periodic certificate refreshes are standard industry practice to maintain strong cryptographic security. Although PCs will function with expired certificates, they will enter a "degraded security state," potentially limiting future updates and causing compatibility issues. The new certificates began rolling out with the Windows 11 KB5074109 update last month.

Key takeaway

For CTOs managing Windows fleets, ensure your update policies are configured to automatically deploy the latest Windows platform updates, specifically KB5074109 and subsequent releases. This proactive measure prevents devices from entering a "degraded security state" due to expired Secure Boot certificates, safeguarding against future compatibility issues and maintaining robust boot-level security across your organization's hardware. Pay special attention to specialized systems like servers or IoT devices, as they may require different update processes or third-party firmware updates.

Key insights

Microsoft is proactively refreshing Secure Boot certificates to maintain system integrity and prevent security degradation.

Principles

• Periodic certificate refresh is standard.
• Expired certificates degrade security state.

Method

Microsoft is deploying new Secure Boot certificates via regular Windows platform updates, with most users receiving them automatically, though some specialized systems or older hardware may require additional firmware updates.

In practice

• Check for Windows 11 KB5074109 update.
• Verify firmware updates for older hardware.

Topics

• Secure Boot
• Windows Security
• Cryptographic Certificates
• System Updates
• Hardware Security

Best for: CTO, IT Professional, Tech Journalist, General Interest

Related on AIssential

• Your PC's critical security certificates may be about to expire - how to check — Expiring 2011 Secure Boot certificates require updates to maintain PC security and boot functionality by June 2026.
• Linux users face a Microsoft Secure Boot headache - here's the painkiller — Expiring Microsoft Secure Boot certificates in 2026 necessitate firmware updates and distro compatibility checks for Linux users.
• Your Certs Are Expiring: Digital Certificate Management Explained — Digital certificates are critical machine identities; their automated lifecycle management is essential to prevent outages and secure modern infrastructure.
• Microsoft 365 Android Apps Had a Token Flaw IT Teams Should Check Now — A forgotten debug flag in a shared Microsoft SDK enabled unauthorized token access across six Microsoft 365 Android apps, risking sensitive data exposure.
• Microsoft patches record 198 Windows bugs in June update - and 3 are zero days — AI-assisted analysis, exemplified by Claude Mythos, dramatically accelerates vulnerability discovery and patching in software.
• BellSoft Survey Finds Container Security Practices Are Undermining Developers’ Own Goals — Current container security practices often increase attack surfaces and lead to frequent breaches due to human error and complex tooling.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by The Verge.