Secure Boot certificates are expiring: what to do on an older PC

What Secure Boot does

When a PC turns on, the firmware (the BIOS, or UEFI on anything from the last decade or so) loads a small program that starts Windows. Secure Boot makes the firmware check that program's digital signature first. If it isn't signed by someone the PC trusts, it doesn't run.

That blocks a nasty kind of malware called a bootkit, which loads before Windows and its antivirus can see it. Windows 11 expects a PC that supports Secure Boot, and it's been standard on PCs since around 2012.

The list of who the PC trusts is stored in the firmware as a handful of certificates. Most of them came from Microsoft in 2011, and those are the ones expiring.

What's changing in 2026

Microsoft is replacing them with 2023 versions, delivered through Windows Update. PCs sold from 2024 on usually shipped with the new ones already.

The important part for home users: nothing breaks on the expiry dates. Your PC keeps booting, Windows keeps updating, and your programs keep working. What changes is that a PC still on the 2011 certificates can't receive new boot-level protections after them, so it slowly falls behind. It's similar to a car that still runs fine but can't get recall fixes anymore.

Check your PC

The quick way: click Start, open Windows Security, and choose Device security. Read the text under Secure Boot, not just the color of the icon. The icon is green when everything's up to date, yellow when an update is pending or Windows needs more information about your firmware, and red when something is blocking the update. Red often means you need a BIOS update.

The definite way: right-click Start, open Terminal (Admin) or PowerShell (Admin), and paste this line:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

• True: the new certificate is in your firmware. You're set.
• False: you're still on the old one. Install all Windows updates, restart a couple of times, and check again. If it stays False, see the BIOS section below.
• An error saying Secure Boot isn't supported or is off: your PC boots in Legacy BIOS mode, or Secure Boot is switched off. The Secure Boot section of my Windows 11 check guide shows how to tell which and how to fix it.

You may also notice a new folder, C:\Windows\SecureBoot. It holds sample scripts for IT departments. It isn't malware, and you can ignore it.

Update the BIOS on an older PC

On some older PCs, Windows can't finish the certificate change until the firmware itself is updated. The makers publish BIOS updates on their support sites, and their own apps can install them for you:

Not sure of your model or serial number? Here's how to find them.

A BIOS update is safe when you follow a few rules:

1. Find your BitLocker recovery key first, if your drive is encrypted. Sign in at aka.ms/myrecoverykey with your Microsoft account and write it down. Firmware changes can make Windows ask for it.
2. Plug a laptop into the charger, and make sure the battery is charged. Most updaters refuse to run on battery alone.
3. Close everything and run the updater. The PC restarts, shows a progress screen, and may restart again.
4. Don't turn it off while the update runs, even if the screen goes black for a minute. A power cut mid-update is the one way this goes wrong.
5. Back in Windows, install any pending updates and check Device security again.

Windows 10, unsupported Windows 11, and Linux

• Windows 10: the new certificates come through Windows Update, so a Windows 10 PC only gets them if it's enrolled in Extended Security Updates. Enrollment is free for most people and runs until October 12, 2027.
• Windows 11 installed with Secure Boot turned off: if you used a workaround to put Windows 11 on an unsupported PC and switched Secure Boot off along the way, the new certificates can't be applied. If the PC boots in UEFI mode, turning Secure Boot back on in the BIOS usually lets the update finish, and Windows 11 installed with Rufus generally still starts with it on. If it boots in Legacy mode, Secure Boot doesn't apply to it at all.
• Linux: most Linux versions start through a small loader signed with Microsoft's third-party certificate, so dual-boot and Linux-only PCs are affected too. Keep your Linux system and your BIOS updated, since future Linux install media may expect the 2023 certificate. If a newer Linux USB stick won't boot on an older PC with Secure Boot on, a BIOS update is the first thing to try.

If your PC can't get the update

Some PCs simply won't get a BIOS update for this. PCWorld reported that Dell doesn't provide BIOS updates for systems whose support ended before January 1, 2026, that HP excludes PCs from 2018 and earlier, and that Lenovo's situation is similar.

If that's your PC, it isn't an emergency. It keeps working and keeps getting regular Windows updates. You lose some future protection against boot-level malware, which is rare and mostly aimed at bigger targets than a home PC. Sensible steps:

• Leave Secure Boot on. The old certificates still protect against the threats they already know about.
• Keep Windows, your browser, and your antivirus updated. That's where nearly all home PC attacks come from.
• Treat it as one more sign of age when you plan what's next. If the PC can't run Windows 11 either, it may be time to think about Linux or a refurbished replacement.