In a recent development concerning Windows Secure Boot, Microsoft has acknowledged that several older certificates have expired, prompting a need for updates among Windows 10 and 11 users. The absence of these updates can hinder the Secure Boot feature, which is essential for ensuring secure startups on devices.
Current Status of Certificate Updates
Microsoft has confirmed a temporary halt in the issuance of new Secure Boot certificates for specific PCs, particularly affecting various HP models. According to their support page, the majority of PCs will receive the necessary updates automatically through Windows Update. However, some devices may require a firmware update from the manufacturer before these updates can be installed.
For users encountering issues, Windows Security may display messages indicating that Secure Boot certificate updates are either paused or blocked. These messages include:
- Devices in this group are affected by a known issue. To reduce risk, Secure Boot certificate updates are temporarily paused while Microsoft and partners work toward a supported resolution. Contact your device manufacturer for assistance.
- Secure Boot is on, but your device does not support the automated Secure Boot certificate update due to hardware or firmware limitations. Contact your device manufacturer for assistance.
Until HP and other impacted manufacturers release the necessary firmware updates, users will be unable to proceed with updating their Secure Boot certificates. While the immediate risk posed by outdated certificates remains low, it is expected to escalate over time.
Implications of Expired Certificates
Microsoft has provided clarity on the situation for devices with un-updated Secure Boot certificates. They state that even if a device reaches its certificate expiration date, it will continue to function normally, and standard Windows updates will still be applied. However, the device will not receive new security updates that address emerging threats, leaving it vulnerable over time.
As new security challenges arise, devices operating with expired certificates may find essential features—such as device encryption or certain startup software—ceasing to function correctly if they depend on updated security measures.
Note: For those using Windows 11 Home, consider the advantages of upgrading to Windows 11 Pro. A comparison of the two versions reveals significant benefits, and the upgrade is currently available at a discounted price in the PCWorld Software Store.
