certificate updates Archives

Winsage

June 29, 2026

OEMs reveal Windows 11 Secure Boot fix after deadline passes, here’s how to update your PC

Major PC manufacturers, including HP, Dell, ASUS, Lenovo, MSI, Acer, Samsung, LG, and Microsoft’s Surface division, have provided guidance on transitioning to new Secure Boot certificates as the expiration of Microsoft’s 2011 certificates approaches. The expiration will occur in three phases: Microsoft Corporation KEK CA 2011 expired on June 24, 2026; Microsoft UEFI CA 2011 expired on June 27, 2026; and Microsoft Windows Production PCA 2011 is set to expire on October 19, 2026. Microsoft has begun rolling out replacement certificates through Windows Update, contingent on OEMs providing compatible BIOS updates. ASUS offers detailed documentation for both consumer and commercial devices, confirming that most users will receive updates automatically. Lenovo provides direct download links for BIOS updates organized by product family and specifies which products will not receive updates. Dell's support article covers its entire product lineup, noting that devices with an End of Service Life before January 1, 2026, will not receive updates. HP outlines a dual-track approach for updates, with specific timelines for commercial PCs. Microsoft's Surface devices receive updates directly from Microsoft, while MSI categorizes guidance based on processor generation for its laptops. Acer emphasizes backing up the BitLocker recovery key and provides a model table for confirmed BIOS release dates. Samsung confirms that all PCs running Windows 10 or 11 will function normally post-expiration, but security updates will cease. LG has released a guide for checking BIOS updates for its PCs. To verify if a PC has the 2023 certificates, users can check the Secure Boot section in Windows Security. A green checkmark indicates successful application, while yellow or red icons indicate pending updates or incompatibility. Microsoft has pushed the certificates to all eligible devices as of June 2026.

Winsage

June 25, 2026

Windows 11 Secure Boot update released to all, hours ahead of expiry

Microsoft has begun rolling out the Secure Boot 2023 certificate update to eligible Windows 11 and Windows 10 PCs ahead of the expiration of the Microsoft Corporation KEK CA 2011 on June 24, 2026. This update enhances device targeting data for automatic Secure Boot certificate updates. Secure Boot is a firmware-level security feature that verifies digital signatures of boot components to prevent rootkits and bootkits. The certificates for Secure Boot were first issued in 2011, with subsequent expirations for related certificates occurring in June and October 2026. Users can check their Secure Boot certificate status through the Windows Security app or System Information. If a PC does not receive the update, it will still boot normally but will lose the ability to receive future boot-level security updates. Multiple restarts after updates are expected due to the Secure Boot certificate process. A new folder, C:WindowsSecureBoot, is not malware but is used for staging cryptographic certificate files. Windows 10 users enrolled in the Extended Security Updates program will also receive the Secure Boot update, while those not enrolled will not. The expiration of the KEK CA 2011 means Microsoft will not be able to sign new Secure Boot revocation payloads using the old key, but existing signed payloads will remain functional.

Winsage

June 24, 2026

Windows 11 Secure Boot update released to all, hours ahead of expiry

Microsoft has begun rolling out the Secure Boot 2023 certificate update for eligible Windows 11 and Windows 10 PCs ahead of the expiration of the original certificates on June 24, 2026. The update includes additional device targeting data to increase coverage for automatic updates. Devices receive the new certificates after demonstrating successful update signals. The original Secure Boot certificates were issued in 2011, with expiration dates set for June 24, 2026, June 27, 2026, and October 19, 2026. Microsoft has been distributing replacement 2023 certificates since 2024, with the June 2026 update expanding eligible devices significantly. Users can check their Secure Boot status through the Windows Security app or System Information. If a PC did not receive the update, it will still function normally but may not receive future boot-level security updates. Multiple restarts after updates are expected behavior, and the SecureBoot folder in Windows is not malware. Windows 10 users in the Extended Security Updates program are also receiving the Secure Boot update. The expiration of the Microsoft Corporation KEK CA 2011 on June 24 means no new Secure Boot revocation payloads can be signed with the old key, but existing signed payloads will continue to function.

Winsage

June 23, 2026

In 2011, Microsoft signed the Secure Boot certificates that still sit inside millions of Windows PCs, and the first one expires on June 24, 2026, leaving unupdated machines running normally while future boot-level revocations stop reaching them

Microsoft's Secure Boot certificates, including the Microsoft Corporation KEK CA 2011, will expire on June 24, 2026, followed by the Microsoft UEFI CA 2011 on June 27 and the Microsoft Windows Production PCA 2011 on October 19. New certificates issued in 2023 will replace these older ones. While devices will continue to operate and receive standard Windows updates, they will gradually lose access to critical security updates that protect against boot-level threats. After June 24, the ability to sign new disallowed signature database payloads with the old KEK will be lost, reducing the capacity to revoke compromised bootloaders. Users are advised to keep Windows and firmware updates current, while enterprises may face challenges managing diverse machine inventories for updates.

Winsage

June 16, 2026

Windows 11 KB5094126 BSODing, freezing, forcing BitLocker lockout, breaks OneDrive, and more

Microsoft rolled out Patch Tuesday updates for Windows 11, specifically KB5094126 and KB5093998, along with dynamic updates KB5094149, KB5095971, and KB5094156. Users have reported various issues post-update, including access difficulties with OneDrive and Dropbox, BitLocker recovery lockouts, and blue screens of death (BSOD), particularly the 0xc0430001 error on HP systems. This error may be linked to a previous bug affecting HP devices related to Secure Boot certificate updates. Users experiencing this error are advised to verify the presence of the boot.stl file on their installation media, as it is essential for Secure Boot. Microsoft recommends using the Update WinPE script to ensure the boot.stl file is included or manually transferring it from the WindowsBootEFI directory. Additionally, some Lenovo PC users have reported system freezes after the update. One user identified a conflict between KB5094126 and User Account Control (UAC) that affects OneDrive and Dropbox access in Explorer, noting that enabling UAC resolves the issue.

Winsage

May 26, 2026

FAQ: What you need to know about expiring Windows Secure Boot certificates

Secure Boot is a security mechanism that authenticates firmware-based software through trusted certificates during the startup process of Windows, preventing unauthorized code execution. It is part of the UEFI firmware standard and was introduced in 2011 to allow only verified, signed code to run at startup. Microsoft first implemented Secure Boot certificates in 2011 as an optional feature in Windows 8, and it remained optional in Windows 10. However, it became a mandatory requirement with the launch of Windows 11 in 2021, indicating the widespread adoption of UEFI systems.

Winsage

May 21, 2026

Windows 11’s new SecureBoot folder isn’t malware. Here’s what it does

Users have observed a new folder named “SecureBoot” in the Windows system folder following the installation of Windows 11's May update (KB5089549). This update may cause installation issues for some devices and introduces a directory that contains example scripts for IT professionals to manage Secure Boot certificate updates. Windows Secure Boot certificates are set to expire next month, and outdated certificates will lead to loss of support starting in June, potentially compromising Secure Boot functionality. Microsoft is distributing new certificates through Windows Update. The SecureBoot folder does not require individual users to take action, and deleting it is discouraged as it may cause complications with future Windows updates.

Winsage

May 10, 2026

‘One Time Restart’—Microsoft Changes Windows After 15 Years

Microsoft is implementing changes to Secure Boot certificates for Windows PCs, marking the first expiration since 2011. New certificates must be installed on all devices before a deadline in June. Users can check their status via the Windows Security App. The new certificates will be distributed through regular monthly security updates, with some users already receiving them in April and others expected to see changes in May. Following these updates, users may experience additional restarts on their PCs. The update applies only to PCs eligible for security updates, meaning many Windows 10 PCs will not receive the new certificates, potentially exposing them to risks. Affected users are advised to enroll in Microsoft’s Extended Security Update (ESU) program.

Winsage

May 5, 2026

Microsoft confirms Windows 11 may restart multiple times after updates and your PC isn’t broken, as it’s due to Secure Boot 2023

Upon installing the April 2026 Patch Tuesday update, some users experienced two or three reboots, which Microsoft confirmed is intentional due to the installation of Secure Boot 2023 certificates. This behavior is expected for a limited number of devices and is part of the Secure Boot update process. The Secure Boot certificates are replacing older ones issued in 2011, set to expire in June 2026. Users can check their Secure Boot status in the Windows Security app, which indicates the status with green, yellow, or red badges. A green badge means the system is up to date, while yellow and red badges indicate issues with certificate updates. Microsoft is managing Secure Boot certificates on modern PCs, but older machines without OEM support may struggle to receive updates due to firmware limitations.

Winsage

April 22, 2026

Microsoft Changes Windows Security After 15 Years—Update By ‘End Of April’

Microsoft is set to expire the Secure Boot authentication certificates that protect Windows PCs from threats upon each restart, with this initiative beginning in April 2023. The update will install new certificates and confirm if user action is necessary, with all devices expected to have the update by the end of April 2026. Users can check their Secure Boot status in Windows Security, where a badge system indicates the status. If the certificates expire, users may be at risk of boot-level malware. Microsoft is enhancing visibility of Secure Boot certificate status to aid user awareness. Users should check their PC by the end of the month to ensure it is updated.