09/03/2026
Back in early 2024, Microsoft announced that it was updating Secure Boot keys as they were going to become 15 years old in 2026, when they would expire.
As such, in June last year, the company shared a timeline of the change.
At the time, the tech giant informed that new certificates would be installed on user PCs via Windows Update, and in fact, the company has already rolled out those with the February 2026 Patch Tuesday updates.
These are the latest Patches on Windows and you can read more about them here (Windows 11 KB5077181, KB5075941| Windows 10: KB5075912).
Microsoft says that the new certs must be installed before June 2026 so make sure to get the February update.
For guidance, the company also published a useful support article which is essentially an FAQ (frequently asked questions) that's meant to help users and admins alike about doubts and enquiries they may have regarding updates to the boot manager.
Microsoft had put up the article in September last year, and a bit bizarrely, Neowin noticed that the company had, for some odd reason, deleted a crucial piece of information from this page.
An earlier version of this article had a couple of questions that answered what would happen if such boot components were not updated in time, highlighting the dangers of not doing so.
The article had stated:
"Q3: What happens if Secure Boot certificates aren’t updated before expiration?
The computer will still start Windows normally, even if the Secure Boot certificates are not updated.
The computer will eventually stop receiving certain Windows security updates from Microsoft including Boot Manager and Secure Boot component security updates.
This will put the device at risk of BootKits that could take full control of the computer."
And:
"Q5: What happens to a device that does not have the new certificates after the old certificates expire.
After the certificates expire, the device will continue to boot without change, however the device will stop getting security updates for the boot manager and the Secure Boot components.
This will put the entire device at risk of “bootkit” malware that can affect all aspects of security on the device."
This information is key to understanding why the Secure Boot updates are necessary for a system, as they can get compromised by bootkits otherwise, but Microsoft may have thought these sections were redundant and deleted them from the very FAQ meant to serve such information to its users.
While Neowin readers and other tech-savvy users out there probably already know this, we should not expect everyone to understand why and how certain Windows 11 security requirements like Secure Boot and TPM help.
Thankfully, someone at the Microsoft headquarters noticed this and the information has been restored again.
The presentation has actually been improved this time, as the description has been expanded, and in fact, this is the very top question now showing that the Redmond company understood its significance, so props to Microsoft for doing so.
Here is what the restored information says now:
"Q1: What happens if my device doesn’t get the new Secure Boot certificates before the old ones expire?
After the Secure Boot certificates expire, devices that haven’t received the newer 2023 certificates will continue to start and operate normally, and standard Windows updates will continue to install.
However, these devices will no longer be able to receive new security protections for the early boot process, including updates to Windows Boot Manager, Secure Boot databases, revocation lists, or mitigations for newly discovered boot level vulnerabilities.
Over time, this limits the device’s protection against emerging threats and may affect scenarios that rely on Secure Boot trust, such as BitLocker hardening or third-party bootloaders.
Most Windows devices will receive the updated certificates automatically, and many OEMs have provided firmware updates when needed.
Keeping your device current with these updates helps ensures it can continue receiving the full set of security protections that Secure Boot is designed to provide."
Microsoft had, for some odd reason, decided to delete a key piece of information about a crucial Windows 11/10 update that you must install.