Impending Changes to Secure Boot Certificates
The countdown has begun. In just a few days, Microsoft will initiate the expiration of Secure Boot certificates on the majority of PCs, a significant milestone after 15 years of stability. This change, set for June, brings with it a shift in user expectations regarding system updates. Initially, users were advised to anticipate a single additional restart; however, recent guidance indicates that multiple restarts will likely be necessary to ensure the security of your device.
These Secure Boot certificates, which have been in place since their introduction in 2011, are now reaching the end of their lifecycle for all PCs manufactured prior to 2023. As Microsoft embarks on this unprecedented journey of certificate expiration, it will simultaneously issue new certificates, a process intricately woven into the security updates released in April and May.
According to Windows Latest, the implications of ignoring the upcoming Secure Boot deadline in June 2026 could be severe. Users may find that their system security deteriorates significantly, as Microsoft will cease to provide critical boot updates and malware blacklists, also known as DBX revocation lists. This highlights the importance of adhering to the update schedule.
As the updates roll out, users can expect their systems to undergo multiple restarts. Microsoft has clarified that this is a normal part of the update process, which involves a series of steps: the first restart occurs when data is pushed into the firmware, followed by a second to load the newly signed bootloader, and a third for the firmware to apply these changes. Depending on the complexity of the updates, additional restarts may occur as the PC downloads and installs the new certificates.
To assist users in navigating this transition, the Windows Security App has received an update to monitor the status of these changes. Users should be vigilant for amber or critical red warnings, which will provide recommended actions. The key indicator to look for is confirmation that Secure Boot is functioning correctly.
As Windows Latest aptly notes, the urgency surrounding this update cannot be overstated. It is crucial for users to verify the status of their PCs, especially those operating on Windows 10, to ensure they are enrolled in the Extended Security Updates (ESU) program. Failing to do so may result in an inability to install new certificates, leaving systems vulnerable to security threats.
