Microsoft Windows: Secure Boot Certificates Expiring

Windows devices are quietly losing an important layer of boot-time security this year, and most businesses won't notice unless something goes wrong.

What it is: The original Secure Boot certificates that protect Windows from tampering during startup are expiring on a staggered schedule through October 2026. Two already expired, on 24 and 27 June.
Who is affected: Any Windows PC that hasn't yet received the newer 2023 Secure Boot certificates, including many business devices managed through Windows Update or Intune.
What the risk is: Affected devices keep working normally day to day, but stop receiving new protections for the startup process, including fixes for future boot-level vulnerabilities.
What action is needed: Microsoft is rolling out the updated certificates automatically through monthly Windows updates. Businesses with managed fleets should confirm devices are covered via Windows Autopatch or Intune reporting rather than assume it has happened.

We recommend asking your IT provider to confirm Secure Boot certificate status across your fleet before the next expiry milestone in October.