Microsoft has warned that several of the Secure Boot certificates baked into Windows devices a decade ago will begin to expire in mid‑2026, forcing a coordinated certificate rollover that every PC owner and IT team should plan for now to avoid loss of pre‑boot updates, compatibility problems...
2011 ca
2023 ca
certificate expiration
certificate rollover
db
dbx
it administration
kek
lcu
linux shim
oem firmware
os update
secure boot
servicing stack update
ssu
svn
uefi
virtual machines
windows secure boot
windows update
Microsoft has confirmed that the original Secure Boot certificates shipped with most Windows PCs are nearing the end of their life, and the transition to new certificates is already underway — a quietly consequential change that affects Windows servicing, OEM firmware, Linux compatibility, and...
Microsoft’s Secure Boot update FAQ makes clear that a coordinated, multi-step transition is now live: Windows will roll new 2023 signing certificates into UEFI variables and update the Windows boot manager to preserve Secure Boot protection ahead of the 2011 CA expirations, but the rollout...
Microsoft has warned that the cryptographic roots underpinning UEFI Secure Boot on Windows devices will begin to expire in June 2026, forcing a global certificate update that every IT team and many end users must plan for now to avoid boot-level insecurities and loss of updateability.
Background...
2026 expiration
bitlocker
bootkit
certificate rollover
db
dbx
group policy
intune
kek
linux shim
mdm
oem firmware
pre-boot security
recovery media
secure boot
uefi
vm
windows 11
windows server
windows update
Microsoft’s new guidance for Secure Boot key creation and management sharpens the playbook OEMs and ODMs must follow to keep Windows devices secure at scale, and it arrives with concrete, time-sensitive actions: recommended key types and sizes, explicit lifecycle controls, and an urgent rolling...
Microsoft’s guidance on Windows Secure Boot key creation and management is a clear signal: organizations and advanced users must prepare now for a multi-year certificate rollover that touches firmware, OS variables, and update pipelines — and that preparation requires coordinated firmware...
Microsoft has published the August 12, 2025 cumulative security update for older Windows 11 branches — KB5063875, which updates OS Builds 22621.5768 and 22631.5768 — delivering a combined Latest Cumulative Update (LCU) and Servicing Stack Update (SSU) for devices still on Windows 11 versions...
22h2
23h2
certificate expiration
copilot reliability
deployment
end of servicing
firmware
intune
kb5063875
kek
lcu
microsoft update catalog
pilot testing
secure boot
security update
ssu
windows 11
windows update
wsus