Microsoft has warned that the original Windows Secure Boot certificates issued in 2011 are set to expire beginning in June 2026, and that systems which do not receive replacement certificates before that date may stop receiving critical pre‑boot security updates — leaving them exposed to...
Microsoft has warned that several of the Secure Boot certificates baked into Windows devices a decade ago will begin to expire in mid‑2026, forcing a coordinated certificate rollover that every PC owner and IT team should plan for now to avoid loss of pre‑boot updates, compatibility problems...
Microsoft has confirmed that the original Secure Boot certificates shipped with most Windows PCs are nearing the end of their life, and the transition to new certificates is already underway — a quietly consequential change that affects Windows servicing, OEM firmware, Linux compatibility, and...
Microsoft’s Secure Boot update FAQ makes clear that a coordinated, multi-step transition is now live: Windows will roll new 2023 signing certificates into UEFI variables and update the Windows boot manager to preserve Secure Boot protection ahead of the 2011 CA expirations, but the rollout...
2011
2011-certs
2023 ca
2023-certs
bios
bitlocker
boot manager
bootkit
ca2023
certificate
certificate expiration
certificate rollover
cve-2023-24932
db
dbx
dual boot
efi
enterprise it
esu
firmware
it administration
kek
lcu
linux
linux boot
linux compatibility
linux shim
oem
oem firmware
os upgrade
recovery
recovery media
recovery usb
rollback
secure boot
servicing stack update
shim
signaturedatabase
ssu
svn
uefi
vendor-update
virtual machine
virtualization
windows 10
windows 11
windows update
Microsoft has warned that the cryptographic roots underpinning UEFI Secure Boot on Windows devices will begin to expire in June 2026, forcing a global certificate update that every IT team and many end users must plan for now to avoid boot-level insecurities and loss of updateability.
Background...
2026 expiration
bitlocker
boot security
bootkit
certificate rollover
db
dbx
group policy
intune
kek
linux shim
mdm
oem firmware
recovery media
secure boot
uefi
vms
windows 11
windows server
windows update
Microsoft’s new guidance for Secure Boot key creation and management sharpens the playbook OEMs and ODMs must follow to keep Windows devices secure at scale, and it arrives with concrete, time-sensitive actions: recommended key types and sizes, explicit lifecycle controls, and an urgent rolling...
Microsoft’s guidance on Windows Secure Boot key creation and management is a clear signal: organizations and advanced users must prepare now for a multi-year certificate rollover that touches firmware, OS variables, and update pipelines — and that preparation requires coordinated firmware...
Microsoft has published the August 12, 2025 cumulative security update for older Windows 11 branches — KB5063875, which updates OS Builds 22621.5768 and 22631.5768 — delivering a combined Latest Cumulative Update (LCU) and Servicing Stack Update (SSU) for devices still on Windows 11 versions...