Windows Secure Boot certificate expiration and CA updates Updates and announcements When Secure Boot certificates expire on Windows devices Secure Boot FAQ Windows devices for home users, businesses, and schools with Microsoft-managed updates Secure Boot certificate update status in the Windows Security app A Closer Look at the High Confidence Database Secure Boot Certificate updates Guidance for IT professionals and organizations Troubleshooting Known issues and resolutions Secure Boot DB and DBX variable update events IT admin guide Secure Boot certificate update status in the Windows Security app PowerShell Using the -Decoded parameter in Get-SecureBootUEFI Registry key updates for Secure Boot Windows devices with IT-managed updates Group Policy Objects (GPO) method of Secure Boot for Windows devices with IT-managed updates Windows Configuration System (WinCS) APIs for Secure Boot Microsoft Intune method of Secure Boot for Windows devices with IT-managed updates Monitoring Secure Boot certificate status with Microsoft Intune remediations Applying Secure Boot certificate update settings using model-based targeting in Microsoft Intune Sample Secure Boot E2E Automation Guide Original Equipment Manufacturer (OEM) pages for Secure Boot Windows Secure Boot Key Creation and Management Guidance Secure Boot Certificate Updates for Azure Virtual Desktop Secure Boot Certificate Updates for Windows 365 Azure Local/HyperConverged Infrastructure Secure Boot update from 2011 to 2023 certificates Trusted Launch VMs (TVM) and Confidential VMs (CVM) Secure Boot certificate updates for Linux on Azure virtual machines Original publish date: June 26, 2025 Updated the certificate table in the "Windows Secure Boot certificates expiring in 2026" section to include the day of the month. Added a new section, " Microsoft Customer Support resources ".

Added a new section " The impact of Secure Boot certificate expiration". Removed the notes marked as " Important " above and below the section " Call to action ". from Microsoft Corporation KEK CA 2023" to "Microsoft Corporation KEK 2K CA 2023" and from "Microsoft Option ROM CA 2023" to "Microsoft Option ROM UEFI CA 2023" What is Secure Boot? Secure Boot is a security feature in Unified Extensible Firmware Interface (UEFI) based firmware that helps ensure that only trusted software runs during a device's boot (start) sequence. It works by verifying the digital signature of pre-boot software against a set of trusted digital certificates (also known as certificate authority or CA) stored in the device's firmware. As an industry standard, UEFI Secure Boot defines how platform firmware manages the certificates, authenticates firmware, and how the operating system (OS) interfaces with this process. For more details on UEFI and Secure Boot, please see Secure boot . Secure Boot was first introduced in Windows 8 to protect against the emerging pre-boot malware (also known as a bootkit) threat at that time. As part of platform initialization, Secure Boot authenticates firmware modules before execution. These modules include UEFI firmware drivers (such as Option ROMs), boot loaders, and applications. As the final step of the Secure Boot process, the firmware verifies if Secure Boot trusts the boot loader. Then, the firmware passes control to the boot loader, which in turn verifies, loads into memory, and starts the Windows OS. Secure Boot defines trusted code through a firmware policy set during manufacturing. Changes to this policy, such as adding or revoking certificates, are controlled by a hierarchy of keys. This hierarchy starts with the Platform Key (PK), typically owned by the hardware manufacturer, followed by the Key Enrollment Key (KEK) (also known as Key Exchange Key), which may include a Microsoft KEK and other OEM KEKs. The Allowed Signature Database (DB) and the Disallowed Signature Database (DBX) determine which code can run in the UEFI environment before the OS starts. The DB includes certificates managed by Microsoft and the OEM, while the DBX is updated by Microsoft with the latest revocations. Any entity with a KEK can update the DB and DBX. The impact of Secure Boot certificate expiration Microsoft is updating the Secure Boot certificates originally issued in 2011 to ensure Windows devices continue to verify trusted boot software. These older certificates begin expiring in June 2026. Devices that haven’t received the newer 2023 certificates will continue to start and operate normally, and standard Windows updates will continue to install. However, these devices will no longer be able to receive new security protections for the early boot process, including updates to Windows Boot Manager, Secure Boot databases, revocation lists, or mitigations for newly discovered boot level vulnerabilities. Over time, this limits the device’s protection against emerging threats and may affect scenarios that rely on Secure Boot trust, such as BitLocker hardening or third-party bootloaders. Most Windows devices will receive the updated certificates automatically, and many OEMs provide firmware updates when needed. Keeping your device current with these updates helps ensures it can continue receiving the full set of security protections that Secure Boot is designed to provide. Windows Secure Boot certificates expiring in 2026 Since Windows introduced Secure Boot support, all Windows-based devices have carried the same set of Microsoft certificates in the KEK and DB. These original certificates are nearing their expiration date, and your device is affected if it has any of the listed certificate versions. To continue running Windows and receiving regular updates for your Secure Boot configuration, you will need to update these certificates. KEK: Key Enrollment Key CA: Certificate Authority DB: Secure Boot Signature Database DBX: Secure Boot Revoked Signature Database *⁠ During renewal of the Microsoft Corporation UEFI CA 2011 certificate, two certificates separate boot loader signing from option ROM signing. This allows finer control over system trust. For example, systems that need to trust option ROMs can add the Microsoft Option ROM UEFI CA 2023 without adding trust for third-party boot loaders. Microsoft has issued updated certificates to ensure continuity of Secure Boot protection on Windows devices. Microsoft will manage the update process for these new certificates on a significant portion of Windows devices. Additionally, we will offer detailed guidance for organizations that manages their own device updates. You may need to take action to ensure that your Windows device remains secure when the certificates expire in 2026. Both UEFI Secure Boot DB and KEK need to be updated with the corresponding new 2023 certificate versions. For more information about the new certificates, see Windows Secure Boot Key Creation and Management Guidance . Your actions will vary depending on the type of Windows device you have. Select from the menu on the left for the type of device and specific action you need to take. Microsoft Customer Support resources To contact Microsoft Support, see: Microsoft Support and then click Windows . Microsoft Support and then click Windows . Support for business and then click Create to create a new support request. After you create the new support request, it should look like the following: Support for business and then click Create to create a new support request. After you create the new support request, it should look like the following: Thank you for your feedback!