Microsoft’s Secure Boot update FAQ makes clear that a coordinated, multi-step transition is now live: Windows will roll new 2023 signing certificates into UEFI variables and update the Windows boot manager to preserve Secure Boot protection ahead of the 2011 CA expirations, but the rollout...
Microsoft has warned that the cryptographic roots underpinning UEFI Secure Boot on Windows devices will begin to expire in June 2026, forcing a global certificate update that every IT team and many end users must plan for now to avoid boot-level insecurities and loss of updateability.
Background...
2026 expiration
bitlocker
bootkit
certificate rollover
db
dbx
group policy
intune
kek
linuxshim
mdm
oem firmware
pre-boot security
recovery media
secure boot
uefi
vm
windows 11
windows server
windows update