Windows Secure Boot Certificates Expire October 19: PCs That Miss the Update Lose Startup Protection

On October 19, 2026, eight days from now, the last of the Secure Boot certificates Microsoft issued in 2011 expires: the one that signs the Windows startup program itself. A PC that has not received the new 2023 certificates will keep working and keep installing regular Windows updates, but Microsoft says new fixes for startup-stage vulnerabilities will no longer reach it. Checking takes no specialist: on each PC, open the Windows Security app, go to Device security, then Secure Boot, and read the message, not just the colour of the icon.

What exactly expires, and when?

Secure Boot is a firmware feature Microsoft introduced with Windows 8. When the machine powers on, it checks that every program running before Windows is signed by a trusted party, which blocks malware that plants itself in the startup stage (bootkits). That check relies on digital certificates stored on the device, all issued in 2011 and all with an expiry date. According to Microsoft's official page on the expiring certificates:

So two expired in June, and the third, the one that matters most for Windows PCs, is a week away. The replacements are dated 2023, and their files have shipped in cumulative updates since May 13, 2025. But shipping in an update does not mean they have been written to the device: Microsoft applies them automatically on many machines, while others need a step from IT or a firmware update from the manufacturer.

What happens to a PC that is not updated?

It will not stop on October 20, and your software will not break. Microsoft's page on what happens when the certificates expire says the device will start normally, regular Windows updates will continue, and browsing, apps and networking stay the same. What stops is:

• Updates to Windows Boot Manager.
• Updates to the revocation list, which blocks startup programs known to be dangerous.
• Fixes for newly discovered vulnerabilities in the startup chain, including mitigations against BitLocker bypasses.

The risk does not show on day one. It grows with every startup vulnerability found after that date whose fix never reaches your machines. These flaws are serious precisely because malware that runs before Windows also runs before your antivirus.

How do you check one PC in a minute?

Since April 2026 the Windows Security app shows the status of the certificates, according to Microsoft's page on update status in the Windows Security app. Open the app, go to Device security, then Secure Boot, and read the message. Here is what each one means:

• All required certificate updates have been applied: the machine is ready and nothing is needed. Microsoft warns that a green checkmark alone is not proof, so read the text.
• The device is using an older trust configuration that should be updated: install the latest Windows updates, restart, and make sure the machine is online.
• The device does not support the automated update due to hardware or firmware limitations: you need an update from the manufacturer.
• The device can no longer receive required updates for the Windows startup experience: the old certificate has expired and the machine was never updated. This needs urgent attention.

If someone on your team uses PowerShell, the command Confirm-SecureBootUEFI in an elevated window returns True when the feature is on. If it is off, the machine is outside this whole update, and Microsoft says it stays exposed to startup-stage malware.

Which machines in your company are most likely to fall behind?

Microsoft tries to update the certificates automatically on machines it manages that send it diagnostic data, but its FAQ page states plainly that the customer is ultimately responsible. These are the cases where the update does not arrive, ordered for a small or mid-sized business:

• Windows 10 PCs without Extended Security Updates: Microsoft says only supported versions of Windows get the new certificates. Check where these PCs stand in our article on Windows 10 end of support for business PCs.
• Machines behind a firewall that blocks diagnostic data: if your network stops that data reaching Microsoft, the automatic update may never arrive.
• Older hardware: some models need a firmware update from the manufacturer, which may only exist for devices still within their support period. Microsoft collects the manufacturer links on a single page.
• Servers and virtual machines: Windows Server 2016 through 2025 are among the covered versions. A virtual machine needs a platform that supports these certificate updates, such as Hyper-V, VMware, Azure or AWS, or an update from the platform provider.
• Point-of-sale terminals, signage screens and operations PCs: they can run for weeks without a restart, and the final step of the update only completes after one.

Three mistakes to avoid

• Do not switch off Secure Boot to make the warning go away. Microsoft says disabling it is not a workaround: it removes the safeguards against startup malware and creates new security and compliance risks.
• Do not reset the BIOS to factory defaults after the update unless the manufacturer has updated the firmware. If Windows has already moved to the startup manager signed with the 2023 certificate, and the factory defaults do not include it, the PC will refuse to start and needs a recovery USB drive to fix.
• Do not dismiss the red warning with the accept-the-risk button. The option exists and needs administrator rights, but it hides the problem without solving it.

The good news: missing the date does not close the door. Microsoft says the updates carrying the new certificates can still be applied after the old ones expire, as long as the machine starts and accepts updates.

A one-week plan before October 19

1. Day 1: list every Windows machine: desktops, laptops, servers, point-of-sale terminals and virtual machines, with manufacturer, model and Windows version.
2. Days 2 and 3: check each one in the Windows Security app, or have IT collect the status automatically with the management tool it already uses, such as Intune.
3. Day 4: install the latest Windows updates on every machine that is behind, then restart it. The update task runs every 12 hours, and its last step waits for a restart.
4. Day 5: for machines that report they cannot take the automatic update, install the firmware update from the manufacturer's site.
5. Days 6 and 7: write down what is left: Windows 10 PCs that are not covered, and hardware outside the manufacturer's support. These go into your replacement plan, and we have written about replacing company devices by priority rather than all at once.

The Origami view

This is an update that never appears on screen and changes nothing in the working day, which is exactly why so many businesses miss it. A machine that was not updated looks perfectly healthy, and the difference only shows when a new startup flaw is found and its fix cannot reach that machine. A business without a list of its devices will not know which ones were left exposed.

If your organisation falls under the National Cybersecurity Authority's Essential Cybersecurity Controls ECC-2:2024, which cover government entities, their companies, and private-sector entities that own, operate or host critical national infrastructure, control 2-3-3-3 requires patch management for systems, applications and devices, and the NCA strongly encourages every other organisation to apply the same controls. A machine that has stopped receiving an entire class of fixes is a gap in that patch management, even if every other update is on schedule.

Conclusion

You have until October 19, 2026 to make sure every Windows machine in your company carries the 2023 certificates. Open the Windows Security app on each one and read the message, install updates and restart, get the firmware update where needed, and never switch Secure Boot off. Whatever cannot be updated goes into the replacement plan. If you need someone to inventory your devices and track their status, get in touch.

Sources

• Microsoft: Windows Secure Boot certificate expiration and CA updates (KB5062710), the certificate table and expiry dates
• Microsoft: When Secure Boot certificates expire on Windows devices (KB5079373), what keeps working and what stops
• Microsoft: Secure Boot certificate update status in the Windows Security app (KB5087130), the messages and what they mean
• Microsoft: Frequently asked questions about the Secure Boot update process (KB5068008), customer responsibility, supported versions and updating after expiry
• Microsoft: Certificate update guidance for IT professionals and organizations (KB5062713), the PowerShell check and the 12-hour update task
• Microsoft: Manufacturer (OEM) pages for firmware updates
• National Cybersecurity Authority: Essential Cybersecurity Controls ECC-2:2024, scope and control 2-3-3-3 (PDF, Arabic)
• Al Rai: Microsoft warns that Secure Boot certificates are expiring (Arabic)