Microsoft Enhances Secure Boot with Ongoing Windows Updates

Microsoft is set to automatically update boot-level security certificates on Windows devices ahead of their expiration later this year. This rollout of new Secure Boot certificates will be part of the regular Windows platform updates, as announced by the company, representing a significant refresh of the security standard.

Secure Boot, which debuted in 2011, was designed to safeguard systems from unauthorized modifications during the boot process and has since become a requirement for Windows 11 hardware. After 15 years, the original Secure Boot certificates from 2011 are due to expire between June and October 2026. A new set of certificates was issued in 2023 and has already been included with many new Windows devices sold since 2024, but older hardware will need an update.

“As cryptographic security evolves, certificates and keys must be periodically refreshed to maintain strong protection,” stated Nuno Costa from Microsoft. “Retiring old certificates and introducing new ones is a standard industry practice that helps prevent aging credentials from becoming a weak point and keeps platforms aligned with modern security expectations.”

Costa noted that while PCs will still operate normally with an expired certificate, they will enter a “degraded security state,” which could restrict future boot-level security updates and lead to compatibility issues with upcoming hardware or software. The new Secure Boot certificates began rolling out with the Windows 11 KB5074109 update last month.

For most Windows 11 users, the new certificates will be installed automatically, requiring no extra steps. However, specialized systems like servers or IoT devices may have different update processes, and some devices might need a separate firmware update from third-party manufacturers. Windows 10 users will need to enroll in Microsoft’s Extended Security Updates to receive the new certificates.