Secure Boot Certificate Expiring June 2026: Windows Security Status Badges Explained

  • Thread Author
Secure Boot is about to become a lot more visible to Windows users, and that is a good thing. Microsoft has confirmed that the Secure Boot certificates shipped with many PCs from 2011 begin expiring in June 2026, and it is now rolling out a Windows Security app status page to show whether a device has already received the replacement certificates. For millions of Windows 10 PCs, the story is more complicated: if the machine is not in Windows 10 Extended Security Updates (ESU), it may not get the new certificates at all, which raises the stakes for anyone still delaying an upgrade.

Overview​

Microsoft’s timing is no accident. The company has been warning for months that the Secure Boot trust chain, which starts in firmware and reaches into Windows boot components, needs to move from the original 2011 certificates to newer 2023 certificates before the older ones age out. That expiration window begins in June 2026 and runs through later months depending on the certificate, which means the problem is not a single switch-flip event but a staged trust-transition across the Windows ecosystem.
The new status page is designed to make that transition legible to ordinary users. In the Windows Security app, under Device security > Secure Boot, Microsoft is adding a badge system that shows whether a device is updated, needs attention, or cannot receive the necessary update path. Microsoft says the feature starts appearing in April 2026, with additional outside-the-app notifications arriving in May 2026.
That change matters because Secure Boot problems are usually invisible until they become urgent. Secure Boot helps ensure the PC only loads trusted software at startup, which is why it is central to defending against bootkits and other low-level malware that can survive a normal reinstall. When that trust model weakens, the result is not immediate chaos; it is a degraded security posture that becomes more dangerous precisely because the machine still seems to work normally.
There is also a broader support story behind the certificate issue. Microsoft ended regular support for Windows 10 on October 14, 2025, and the Secure Boot rollout now intersects with that cutoff. The company’s guidance makes clear that most personal Windows devices on Windows 11, and Windows 10 systems enrolled in ESU, should receive the new certificates automatically through Windows Update, while unsupported Windows 10 PCs should be assumed to be at risk unless specifically proven otherwise.

What Secure Boot Certificates Actually Do​

Secure Boot certificates are not the same thing as a standard Windows patch. They are part of the firmware trust framework that validates code during the earliest phases of startup, before the operating system is fully loaded. In practical terms, they tell the machine which boot components are trusted to run, and which are not. That is why Microsoft treats them as a foundational defense, not just another update item.
The certificate renewal also touches multiple roles inside that chain. Microsoft’s guidance references the KEK, DB, and DBX components used by UEFI Secure Boot, which collectively manage how firmware accepts or rejects boot-time code. If those trust anchors age out without replacement, future boot-level protections may not be deliverable even if the PC continues to install ordinary Windows updates.

Why the expiration matters now​

The biggest misconception is that expiration equals instant failure. Microsoft is explicit that devices will generally keep operating, and everyday use such as browsing, networking, and apps should remain unchanged. But the critical difference is that boot-level protections may no longer be serviceable on a device that has missed the certificate transition, leaving it exposed to future vulnerabilities at the startup layer.
That distinction is important because boot-level attacks are among the hardest to remove. Malware that survives reinstallations or conventional cleanup can hide below the OS line, which means the issue is not simply “security update hygiene” but platform integrity. Microsoft’s posture suggests it wants users to understand that the cost of ignoring the warning may not show up immediately, but it could be severe when a future boot chain vulnerability emerges.
  • Secure Boot protects the earliest boot path.
  • The 2011 certificates are nearing expiration in 2026.
  • New 2023 certificates are intended to preserve trust continuity.
  • Missing the transition mainly affects future boot-level protections.
  • Normal day-to-day Windows use may continue, even on an outdated trust chain.

Microsoft’s New Status Page​

The most user-facing part of this rollout is the Secure Boot status indicator inside Windows Security. Microsoft says the page will show one of three states: a green badge for updated devices, a yellow badge when action is recommended, and a red badge when the PC cannot receive the new secure boot software certificates. That is a notable shift from the old model, where users often had to infer the issue from obscure update behavior or administrative tooling.
The app does more than display a traffic-light icon. It also provides a detailed status message explaining whether the device needs a Windows update, a firmware update from the device maker, or no action at all. That matters because the remediation path is not always controlled by Microsoft alone; in some cases the motherboard or PC OEM needs to provide firmware support before the certificate payload can be applied.

How the badges differ​

The green state is straightforward: the device has received the new certificate set. Yellow is more nuanced, because it signals that Microsoft sees a path forward but also sees a dependency that the user may need to resolve, such as an OEM firmware update. Red is the most serious state, and Microsoft says it appears when a boot-level security vulnerability cannot be serviced because the device never received the updated certificates.
That red-state wording is revealing. It frames the issue as a future inability to receive security coverage, not a current functional break. In other words, Microsoft is trying to avoid false panic while still communicating that a machine can remain operational and still be strategically unprotected in the areas that matter most if attackers start exploiting boot-chain weaknesses.
  • Green: certificates updated.
  • Yellow: action recommended, often via Windows Update or firmware.
  • Red: no supported path to receive the new certificates.
  • Status details can vary by hardware and firmware support.
  • The page appears under Device security > Secure Boot.

Why Windows 10 Users Are the Most Exposed​

The Windows 10 angle is where this becomes more than a technical housekeeping issue. Microsoft ended mainstream support for Windows 10 in October 2025, which means systems staying on the OS without ESU are already outside the normal patch stream. Microsoft has also warned that those unsupported Windows 10 PCs will not receive the new Secure Boot certificates.
That creates an awkward split in the installed base. A Windows 10 PC can still boot, still run familiar software, and still appear healthy, yet be frozen on a trust model that is about to age out. For home users, that is a quiet risk. For businesses, it becomes a fleet-management problem because the devices may continue to function long after they stop meeting Microsoft’s preferred security baseline.

ESU is the dividing line​

Microsoft says the new Secure Boot status indicator is arriving only for Windows 10 ESU PCs. That means if a Windows 10 machine is not enrolled in ESU, users should assume it is not part of the managed certificate-update path. The practical implication is simple: unsupported Windows 10 is not just out of support; it is increasingly out of the security migration plan.
The ESU detail also helps explain why Microsoft has made the interface change now. A visible status page gives the company a way to signal urgency without relying entirely on Windows Update banners or support articles. It also creates a user-friendly feedback loop for people who may not realize that a machine can be “working” while still missing a critical trust update.
  • Unsupported Windows 10 may miss the certificate update path.
  • ESU becomes the gatekeeper for ongoing protection.
  • Home users are more likely to miss the issue until late.
  • Enterprises need inventory-level visibility, not just PC-by-PC checks.
  • The risk is cumulative, not instant.

How Automatic Updates Are Supposed to Work​

Microsoft’s preferred path is automation. On Windows 11 and Windows 10 ESU, the new Secure Boot certificates should arrive automatically through regular monthly Windows updates. That is the cleanest outcome because it minimizes user involvement and keeps the trust chain aligned with Microsoft’s servicing model.
In practice, though, “automatic” does not mean “uniform.” Some systems still need a separate firmware update from the OEM or motherboard manufacturer before they can actually load the new certificates. That is the reason for the yellow warning state, and it reflects a broader truth about Windows security: the OS can only go so far when firmware support lags behind.

The role of monthly quality updates​

Microsoft’s February and March 2026 updates show that the company is using the monthly servicing channel to extend targeting data and increase coverage for eligible devices. In March, Microsoft said quality updates include additional high-confidence device targeting data to expand the pool of systems that can automatically receive new certificates. That suggests a controlled rollout rather than a one-shot push to every machine.
A controlled rollout is prudent, but it also means some users will spend time in a gray area before the status page settles. For consumers, that might be a short delay. For IT departments, it can look like inconsistent compliance across what should be a managed estate, especially where hardware generations and OEM firmware schedules differ.

Sequentially, the update journey looks like this​

  • Windows Update delivers the certificate payload where supported.
  • The device checks whether firmware can accept the new trust anchors.
  • OEM firmware updates may be required if the current BIOS/UEFI is too old.
  • Windows Security displays the final certificate state.
  • If the device cannot be serviced, Microsoft flags it as needing attention or at risk.
  • Monthly updates are the primary delivery mechanism.
  • Firmware is sometimes the hidden dependency.
  • Controlled targeting reduces rollout risk.
  • The status page helps users see whether delivery succeeded.
  • Without an updated firmware path, the OS alone may not be enough.

What the New Warning Means for Security​

Microsoft is careful to say the machine will not suddenly stop working if the certificates are missing. But the wording around a degraded security state should be taken seriously. If future vulnerabilities in the boot process are discovered and cannot be serviced because the certificates are stale, the device could remain permanently exposed in one of the most sensitive parts of the system.
That matters because attackers do not need to break into a fully running Windows desktop if they can compromise the boot chain. Once persistence is established low in the stack, an ordinary reinstall may not be enough to clean it out. Microsoft’s update guidance is therefore as much about preventing unserviceable risk as it is about preserving a checkbox called Secure Boot.

Boot-level vulnerabilities are different​

Most users think of security in terms of browsers, ransomware, and email attachments. Boot-level attacks live beneath that layer, which is why they are so difficult to diagnose and so hard to remediate without full platform trust. When Microsoft warns of “boot-level protections,” it is talking about the part of the stack that can determine whether the operating system is trustworthy at all.
That also explains why Microsoft is not recommending any workaround that disables Secure Boot. In fact, its support materials explicitly say Secure Boot should not be turned off to sidestep certificate expiration. The company is signaling that the answer is not to weaken the startup chain, but to restore it with the newer certificate set.
  • The threat is about future serviceability.
  • Boot-level compromise is harder to detect and remove.
  • Disabling Secure Boot is not a valid workaround.
  • A device can remain functional and still be vulnerable.
  • Trust-chain continuity is the core goal.

Consumer Impact: What Most People Should Do​

For most consumers, the immediate step is to open Windows Security and check the Secure Boot status under Device security. If the badge is green, the job is largely done. If it is yellow, the device likely needs a Windows update, a firmware update, or both, and that is the point at which users should pay attention rather than assume everything is fine.
If the PC is still on Windows 10 and not enrolled in ESU, the guidance is more blunt. Microsoft says unsupported Windows 10 systems should not be assumed to receive the new certificates, which means the safest assumption is that they are not protected for the coming changeover unless a verified update path is in place. For consumers, that usually means either moving to Windows 11, joining ESU where applicable, or replacing hardware that cannot be serviced.

What to check first​

The high-value checks are simple and do not require specialized tools. Users should verify whether Secure Boot is on, confirm the Windows version and support status, and then run Windows Update before hunting for OEM firmware support. If the system still reports a warning, the next stop is the PC maker’s support site or, in some cases, the motherboard vendor.
Microsoft also says users may see an option like “I accept the risks, don’t remind me” if the status page shows a red badge. That is not a fix; it is a notification control. The very existence of that choice underscores that Microsoft wants informed consent around the risk, not confusion or accidental dismissal.
  • Check Windows Security > Device security > Secure Boot.
  • Run the latest Windows Update cycle.
  • Look for OEM firmware updates.
  • Confirm whether the device is on Windows 11, Windows 10 ESU, or unsupported Windows 10.
  • Treat a red badge as a real security warning, not a cosmetic alert.

Enterprise Impact: Fleet Management Gets Harder​

Enterprises will feel this more sharply than consumers because certificate health is a fleet issue, not a single-machine issue. Microsoft’s guidance for IT professionals refers to deployment and monitoring methods, which implies that organizations need visibility across Windows Update, firmware baselines, and hardware compatibility. A handful of out-of-date laptops is annoying; a large population of them is a compliance gap.
The new status page may help endpoint teams, but it is not enough by itself. Many enterprise environments disable or limit consumer-facing enhancements, and Microsoft notes that the new Device security enhancements are disabled by default on enterprise-managed client devices and Windows Server. That means IT departments may need to rely on their own tooling, policies, and inventory systems rather than waiting for the Windows Security app to become the central source of truth.

Fleet complexity and remediation​

The hardest part for enterprises is not installing a patch. It is identifying which devices need a Windows update, which need firmware from a vendor, and which have no viable path because of age or support status. The Secure Boot change spans user space, OS servicing, and firmware, so remediation can stall if any one layer is forgotten.
There is also a lifecycle-management issue. PCs that were acceptable endpoint hardware a few years ago may now be trapped between Windows 10 end-of-support and firmware limitations that prevent the 2023 trust update. That forces organizations to decide whether to spend staff time nursing aging hardware or accelerate replacement. In many cases, the hidden cost of staying put is worse than the sticker shock of upgrading.
  • Enterprises need inventory-level certificate visibility.
  • OEM firmware dependencies complicate remediation.
  • Managed devices may not show the same consumer UI.
  • Policy controls can hide or defer alerts.
  • Old hardware may be the real bottleneck, not Windows Update.

Competitive and Market Implications​

Microsoft’s move also has competitive implications, even if it does not look like a product launch. By surfacing certificate status in Windows Security, the company is making Secure Boot a more visible, first-party managed concern rather than leaving it to security teams, OEM support pages, or third-party utilities. That reinforces Windows as a managed security platform and reduces the room for fragmented messaging.
For hardware vendors, this is a reminder that firmware support is now part of the product story long after a machine ships. If an OEM cannot provide a compatible update path, Microsoft’s yellow and red states effectively externalize that failure back to the vendor. In that sense, the status page acts not only as a diagnostic tool but as a accountability mechanism.

Windows 11 gets a halo effect​

Windows 11 benefits from the narrative that it is the cleaner path forward. Since Microsoft says Windows 11 and Windows 10 ESU should receive the new certificates automatically, the platform message is clear: current, supported Windows gets managed security continuity, while unsupported systems increasingly do not. That is good pressure for upgrades, even if it is uncomfortable for users with hardware that misses the cutoff.
This also creates a subtle market signal around aging PC fleets. Older machines that cannot move to Windows 11 because of system requirements now face not just feature stagnation but a specific trust-chain expiration problem. That can accelerate replacement cycles, especially where organizations are already weighing the total cost of keeping legacy endpoints alive.
  • Microsoft is centralizing the security narrative.
  • OEMs inherit responsibility for firmware readiness.
  • Windows 11 gains a security and support advantage.
  • Legacy hardware faces a sharper replacement conversation.
  • The status page doubles as a vendor accountability tool.

Practical Verification Steps​

The most important thing users can do is verify, not assume. Microsoft’s dashboard is meant to reduce ambiguity, but it should be paired with a basic update checklist so that any warning can be acted on quickly. That is especially true in the months leading up to June 2026, when the first expiration wave begins.
A sound verification flow should start with the OS version, move to Secure Boot status, and then check for firmware updates. If the PC is on Windows 10, the user must also confirm whether the machine is in ESU; if it is not, the machine should be treated as outside the automatic certificate path. This is not the kind of problem that gets fixed by routine rebooting or waiting for “the next update.”

Recommended order of operations​

  • Confirm the Windows version and support status.
  • Open Windows Security and inspect Secure Boot.
  • Run Windows Update and install all pending updates.
  • Check the device maker’s support page for firmware.
  • Recheck the Secure Boot badge after rebooting.
That sequence matters because it separates the layers cleanly. Windows Update can handle the certificate payload when the device is eligible, but firmware support may still block final success. The badge system exists precisely to make that layered dependency visible instead of burying it in a support matrix.
  • Verify support status before assuming protection.
  • Don’t confuse ordinary OS updates with firmware readiness.
  • Reboot after updates so the trust state can refresh.
  • Treat the badge as the current truth, not the previous one.
  • Escalate to the OEM if the machine stalls on yellow.

Strengths and Opportunities​

Microsoft’s approach has several obvious advantages. It turns an obscure, infrastructure-level certificate transition into something users can actually see, while also giving administrators a clearer framework for remediation. Just as importantly, it creates a built-in nudge toward supported Windows versions and away from unmanaged drift.
The company is also smart to phase in notifications instead of dumping every warning at once. A gradual rollout reduces support noise, gives OEMs time to distribute firmware fixes, and allows Microsoft to refine targeting data before the June deadline. That is a more measured strategy than a big-bang trust change, and it should reduce avoidable friction.
  • Gives users a visible status signal.
  • Helps IT teams identify affected devices faster.
  • Encourages upgrades to supported Windows versions.
  • Uses phased rollout to reduce disruption.
  • Makes OEM firmware a visible part of the fix path.
  • Improves communication around a normally invisible risk.

Risks and Concerns​

The biggest risk is complacency. Because PCs will continue to boot and routine tasks may still work, many users may underestimate the importance of the certificate transition until a real vulnerability appears and cannot be serviced. That makes the issue dangerous in exactly the way security problems often are: quiet at first, then suddenly urgent.
Another concern is uneven hardware support. If OEM firmware is delayed, incomplete, or unavailable for older systems, the yellow-to-red transition can become a dead end for some devices. For businesses and consumers alike, that could turn into an unwanted hardware refresh cycle that feels less like a security choice and more like a forced migration.
  • Users may ignore warnings because the PC still seems fine.
  • Older systems may have no viable firmware path.
  • Unsupported Windows 10 devices may fall through the cracks.
  • Enterprise policy settings could obscure visibility.
  • Mixed OEM environments complicate remediation.
  • The risk could surface only after the first serious boot-level exploit.

Looking Ahead​

The key date to watch is June 2026, but the real story begins earlier, with Microsoft’s April and May 2026 interface changes. By the time the first certificates start expiring, the company wants users and administrators to know which devices are updated, which need action, and which are effectively stuck. That is a sensible preparation strategy, but it will only work if users actually check the status pages and act on what they see.
A second thing to watch is OEM responsiveness. Microsoft can distribute the Windows side of the fix, but the remaining gaps may be decided by motherboard and PC vendors. If firmware updates arrive late for certain models, the red and yellow statuses could become a practical measure of vendor support quality as much as Microsoft compliance.

Watch list​

  • April 2026: the Secure Boot status UI begins appearing.
  • May 2026: system alerts and extra guidance expand.
  • June 2026: the first certificate expirations begin.
  • OEM firmware releases for older devices.
  • How many Windows 10 devices remain outside ESU.
  • Whether Microsoft expands enterprise reporting and management tools.
The broader lesson is that platform security is becoming increasingly lifecycle-driven. A modern Windows PC is no longer “secure” because it once shipped with the right settings; it is secure because its update pipeline, firmware, and trust anchors continue to be maintained together. That is an uncomfortable reminder for anyone still relying on an old Windows 10 install, but it is also the clearest possible signal that the next generation of Windows security will be judged by continuity, not just configuration.

Source: PCMag UK Windows Secure Boot Certificates Expire in June. How to Verify Your PC Is Updated