This article describes an update that enables urgent updates for the Windows Root Certificate Program in Windows 8.1, Windows RT 8.1, Windows Server 2012 R2, Windows 8, Windows RT, Windows Server 2012, Windows 7, and Windows Server 2008 R2.

This software update introduces a new tool that administrators can use to view the set of trusted root certificates in the Microsoft Root Certificate Program. This tool is for administrators who manage the set of trusted root certificates for an enterprise environment.

This updater expands on the existing automatic root update mechanism technology that is found in Windows Vista and in Windows 7 to let certificates that are compromised or are untrusted in some way be specifically flagged as untrusted.

Updated 2023 certificates are being delivered automatically through Windows Update. The Windows Security app now shows whether your device has received these updates, what your current status is, and whether any action is needed.

The Microsoft Secure Boot certificates originally issued in 2011 begin expiring in June 2026. To maintain protection against new boot‑level threats, Microsoft is updating devices with a new set of 2023 certificates.

This article describes an update that enables urgent updates for the Windows Root Certificate Program in Windows 8.1, Windows RT 8.1, Windows Server 2012 R2, Windows 8, Windows RT, Windows Server 2012, Windows 7, and Windows Server 2008 R2.

Updated 2023 certificates are being delivered automatically through Windows Update to consumer devices and some business devices. The Windows Security app now shows whether devices have received these updates, their current status, and whether any action is needed.

These original certificates are nearing their expiration date, and your device is affected if it has any of the listed certificate versions. To continue running Windows and receiving regular updates for your Secure Boot configuration, you will need to update these certificates.

This document describes support for deploying, managing, and monitoring the Secure Boot certificate updates using Windows registry keys. The keys consist of the following:

When you target a device for updates, a setting is made on the device to indicate that the device should begin the process of applying the new certificates. A scheduled task runs on the device every 12 hours and detects that the device has been targeted for the updates.