Microsoft Secure Boot 2011 certificates expire starting June 2026. The certificate is mandatory requirement when using the secure boot feature of Windows 10 and 11.

What is Secure Boot and why is an update required

Secure Boot helps to prevent malware from running early in the startup sequence of a Windows device. Coupled with the Unified Extensible Firmware Interface (UEFI) firmware signing process, Secure Boot uses cryptographic keys, known as certificate authorities (CAs), to validate that firmware modules come from a trusted source.

After 15 years, the Secure Boot certificates that are part of Windows systems will start expiring in June 2026. Windows devices will need new certificates to maintain continuity and protection.
Affected: Physical and virtual machines (VMs) on supported versions of Windows 10, Windows 11, Windows Server 2025, Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012, Windows Server 2012 R2—the systems released since 2012, including the long-term servicing channel (LTSC).

More information from Microsoft can be found in the Microsoft KB article, including certificate specifics: Windows Secure Boot certificate expiration and CA updates.

What happens if the update is not performed

Systems that run the secure boot feature with outdated certificates will continue to boot, but may experience:

• • Inability to receive Secure Boot related updates.
• • Possible boot failures if the Secure Boot feature is disabled or BIOS default are reset.
• • Vulnerabilities to bootkit malware.

Resolution

Roda and Mildef offer firmware updates for products listed below. Please contact the Roda Service Center to obtain the updates. For devices listed under items 9–13, you can contact Mildef directly.

• • BIOS updates include the 2023 Secure Boot certificates
• • Microsoft pushes updates to the active Secure Boot database using Windows Update
•