Urgent Windows Update: Secure Boot Certificates Expire in June 2026 – What You Need to Know

Microsoft has issued an urgent warning to Windows users regarding the impending expiration of Secure Boot certificates, a critical component in the system's startup security. These certificates are set to expire starting in June 2026, potentially affecting the ability of personal and business computers to boot securely if not properly updated. To address this, Microsoft released an out-of-band update (KB5064489) on July 13, 2025, designed to mitigate immediate security concerns and prepare systems for the upcoming certificate transition.

Understanding Secure Boot and Its Importance​

Secure Boot is a security feature embedded in the Unified Extensible Firmware Interface (UEFI) that ensures only trusted software runs during a computer's startup process. By verifying the digital signatures of boot loaders and firmware drivers against a set of trusted certificates, Secure Boot helps prevent malicious software, such as bootkits, from compromising the system at startup. This mechanism is vital for maintaining the integrity and security of the operating system from the moment the device powers on.

The Impending Certificate Expiration​

The original Secure Boot certificates, issued in 2011, are nearing their expiration dates:

• Microsoft Corporation KEK CA 2011: Expires in June 2026.
• Microsoft Corporation UEFI CA 2011: Expires in June 2026.
• Microsoft Windows Production PCA 2011: Expires in October 2026.

These certificates are integral to the Secure Boot process, and their expiration could lead to boot failures or security vulnerabilities if not addressed. To ensure continued protection, Microsoft has introduced updated certificates:

• Microsoft Corporation KEK CA 2023: Replaces the 2011 KEK certificate.
• Microsoft Corporation UEFI CA 2023: Replaces the 2011 UEFI CA certificate.
• Windows UEFI CA 2023: Replaces the Windows Production PCA 2011 certificate.

These new certificates will maintain the integrity of the Secure Boot process and ensure that systems can continue to boot securely and receive necessary updates.

Microsoft's Response: Out-of-Band Update KB5064489​

In anticipation of the certificate expiration, Microsoft released update KB5064489 on July 13, 2025. This update, carrying the OS Build number 26100.4656, includes essential quality improvements to ensure system stability and prepares systems for the upcoming certificate transition. Notably, it addresses issues that prevented certain Azure Virtual Machines from starting when Virtualization-Based Security (VBS) was enabled, particularly affecting VMs using version 8.0 where VBS was offered by the host. This fix is crucial for businesses relying on Azure’s cloud infrastructure.

Steps for Users and IT Administrators​

Microsoft strongly recommends that users and IT administrators take proactive steps to update certificates well in advance of the June 2026 deadline. The company has published detailed guidance to help users navigate the certificate renewal process smoothly. Key actions include:

1. Review and Apply Updates: Ensure that all systems are updated with the latest Windows updates, including KB5064489, to prepare for the certificate transition.
2. Verify Secure Boot Status: Check that Secure Boot is enabled on all devices. This can be done by pressing Windows key + R, typing msinfo32, and verifying the Secure Boot State.
3. Coordinate with OEMs: Apply any available firmware updates from Original Equipment Manufacturers (OEMs) before updating the certificates, as firmware updates are foundational for Secure Boot updates to apply correctly.
4. Enable Diagnostic Data: For enterprise IT-managed systems, configure organizational policies to allow at least the “required” level of diagnostic data. This enables Microsoft to manage Secure Boot-related updates effectively.
5. Set Registry Key for Updates: Allow Microsoft to manage Secure Boot-related updates by setting the following registry key:
   • Registry path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot
   • Key name: MicrosoftUpdateManagedOptIn
   • Type: DWORD
   • DWORD value: 0x5944
   This setting indicates that all certificates should be updated in a manner that preserves the security profile of the existing device.

Implications of Inaction​

Failing to update the Secure Boot certificates before their expiration dates can have significant consequences:

• Loss of Security Updates: Devices may lose the ability to install Secure Boot security updates after June 2026.
• Untrusted Software: Systems may not trust third-party software signed with new certificates after June 2026.
• Increased Vulnerability: Devices may not receive security fixes for Windows Boot Manager by October 2026, leaving them exposed to boot-level malware attacks.

Proactive updating is essential to maintain system security and functionality.

Conclusion​

The impending expiration of Secure Boot certificates is a critical issue that requires immediate attention from all Windows users and IT administrators. By understanding the importance of Secure Boot, recognizing the implications of certificate expiration, and following Microsoft's guidance to update certificates and apply necessary updates, users can ensure their systems remain secure and operational. Staying informed and proactive in this process is vital to maintaining the integrity and security of Windows devices.

---

Source: gbhackers.com Windows Secure Boot Certificate Expired in June, Microsoft Issues Warning

 

[tweaking]

Secure Boot certificate expiration poses a serious security risk—use Advanced PDF Editor to annotate Microsoft’s update guidance and ensure timely compliance for uninterrupted Windows protection.

 

[ChatGPT]

You’re absolutely right: Secure Boot certificate expiration is a critical, underappreciated risk that can undermine the Windows boot chain’s integrity and leave systems vulnerable to advanced threats. Microsoft’s update guidance is dense, so using tools like Advanced PDF Editor to annotate and highlight key compliance steps ensures your IT teams or end-users stay on track and deadlines aren’t missed.
Here’s how you can annotate and operationalize Microsoft’s Secure Boot update guidance:

---

1. Understand the Risk & Timeline​

• Expired Secure Boot certificates can allow unsigned or malicious code to bypass the boot protections, putting the entire system at risk—even before Windows loads.
• Microsoft’s mitigation involves phased updates, certificate revocation, and tight integration with third-party firmware vendors. Delayed action can mean your system becomes unbootable or vulnerable to firmware-level malware.

---

2. Annotate Guidance for Action​

• Import Microsoft’s official guidance PDF into Advanced PDF Editor.
• Use highlighting on:
  • Deadlines for updates/patches
  • Steps for checking certificate validity
  • Essentials for firmware updates (collaboration with vendors, required BIOS updates)
• Add callout annotations:
  • Next to procedures for enabling Secure Boot or checking its status
  • For required PowerShell or UEFI configuration commands

---

3. Document & Track Compliance​

• Use comment boxes for internal notes—e.g., assign steps to IT owners or document completion dates.
• If the PDF contains tables (e.g., devices or firmware versions affected), use stamps or checkmarks as you verify compliance for each entry.

---

4. Distribute and Monitor​

• Export the annotated PDF and share with compliance teams, IT staff, or executives.
• Schedule reminders relative to key milestone dates presented in the guidance.

---

5. Best Practice: Continuous Vigilance​

• Even after initial compliance, document a recurring review process since new certificates or firmware updates may be published in the future.

---

Summary of Actionable Steps

• Promptly install all Secure Boot and firmware-related updates from Microsoft and hardware vendors.
• Use Advanced PDF Editor to annotate deadlines, technical steps, and assign responsibilities within Microsoft’s documentation.
• Confirm Secure Boot is enabled and all signed firmware is current.
• Document your compliance for any audits or future patch cycles.

If you’d like a sample annotation workflow or have a specific Microsoft PDF you need marked up, let me know—happy to provide a template or more tailored advice!