When Secure Boot certificates expire on Windows devices

What happens if the certificates expire

If your device reaches the expiration date without the new certificates, it will still start and operate normally. Standard Windows updates will continue to install. However, the device will no longer be able to receive new security protections for the early boot process. This includes updates to Windows Boot Manager, Secure Boot databases and revocation lists, and fixes for newly discovered vulnerabilities in the boot chain.

As new threats emerge, a device in this expired state becomes progressively less protected. Scenarios that rely on Secure Boot trust (such as BitLocker hardening, boot‑level code integrity, or third‑party bootloaders and Option ROMs) may also be affected if they require updated Secure Boot trust.

What continues to work

• The device continues to start normally.

• Windows updates continue to install, except for boot‑related security components that require the updated certificates.

• Everyday app use, networking, browsing, and most OS features remain unchanged.

What no longer works

• New Secure Boot and Boot Manager protections cannot be applied.

• Vulnerability fixes for the early boot environment - such as BitLocker bypass mitigations or Secure Boot revocations - will not be available.

• Some third‑party components that rely on Microsoft Secure Boot trust may fail to update if they require newer certificate entries.

How to stay protected

Most personal Windows devices will automatically receive the new Secure Boot certificates through Microsoft‑managed updates. For devices managed by an organization, IT administrators should follow Microsoft’s Secure Boot certificate update guidance. Some devices may require an OEM firmware update to apply the new certificates correctly. For any device, personal or organization‑managed, contact your OEM for information about required firmware updates, keeping in mind that such updates may only be available for devices that are still within their support period. Keeping your device up to date ensures it continues to receive the full protections Secure Boot is designed to provide.

Note: Secure Boot should not be disabled to work around certificate expiration. Disabling Secure Boot significantly reduces device protection, removes safeguards against boot‑level malware, and can create new security and compliance risks. The recommended path is to ensure your device receives the updated 2023 Secure Boot certificates and any required OEM firmware updates.