Why Windows Is Updating Secure Boot Certificates—and What You Need to Do

Windows PCs are receiving an important security maintenance change that most people should not have to manage manually: updated Secure Boot certificates.

Secure Boot helps a PC verify trusted software during the startup process. Microsoft says certificates originally issued in 2011 begin expiring in June 2026, so Windows devices need newer certificates to continue receiving Secure Boot protections and future security updates associated with the boot process.

Do you need to edit the BIOS yourself?

For an ordinary home PC, usually no.

Microsoft says Windows Update is delivering the new Secure Boot certificates to eligible devices. The process can happen gradually, and Microsoft recommends keeping Windows updates current.

Do not enter UEFI or BIOS settings and start deleting or replacing Secure Boot keys simply because you read that certificates are expiring. Incorrect firmware changes can create startup problems.

How to check Secure Boot status

Press Windows key + R, type msinfo32, and press Enter.

In System Information, look for Secure Boot State. On a compatible system using Secure Boot, it should normally show On.

This screen is for checking status. You do not need to change firmware settings just because you opened it.

What if Secure Boot is off?

There are legitimate reasons a particular PC may have Secure Boot disabled, especially on custom-built systems or computers with unusual operating-system configurations. Turning it on can require firmware changes and may affect how the computer starts.

If the PC is working normally and you are uncertain why Secure Boot is disabled, stop before changing firmware settings. Check the computer or motherboard manufacturer's documentation first.

For most Windows 11 home users, the practical advice is much simpler: keep Windows Update working and allow Microsoft to deliver the certificate updates through the supported process.

Sources and Further Reading

Microsoft — Secure Boot certificate expiration and CA updates: https://support.microsoft.com/en-us/topic/windows-secure-boot-certificate-expiration-and-ca-updates

Microsoft — Windows 11 September 2026 update information: https://support.microsoft.com/en-us/servicing/os/windows-11/2026/09/kb5124008-windows-11-24h2-25h2-security-update