Microsoft has begun rolling out a critical security update for Windows devices that refreshes the system’s Secure Boot certificates. The update is being delivered through Windows Update and is designed to ensure Windows systems remain secure as older certificates approach expiration.
Why This Update Matters
The update replaces the original 2011 Secure Boot certificates, which are scheduled to begin expiring in June 2026. Secure Boot is an essential security feature in Windows 11 and Windows 10 that helps protect computers from malicious software during the startup process.
Without updated certificates, some systems could eventually face boot or security verification issues once the older keys expire.
What Secure Boot Does
Secure Boot ensures that only trusted software loads when a computer starts. It works with modern firmware standards such as Unified Extensible Firmware Interface, checking cryptographic signatures before allowing operating systems and drivers to run.
This helps block threats like bootkits and rootkits that attempt to infect systems before the operating system fully loads.
How to Install the Update
For most users, installing the update is simple:
Open Windows Settings
Go to Windows Update
Check for updates
Install the security update
Restart the PC
Once installed, the new certificates will replace the older ones automatically.
What Users Should Know
Microsoft says the process should be automatic for most devices, and users typically only need to install the update and reboot their system. However, organizations and IT administrators may need to verify that systems are properly updated, especially in enterprise environments.
Keeping Secure Boot certificates up to date helps ensure Windows devices remain protected against low-level security threats.
