Microsoft Rolls Out Automatic Secure Boot Certificate Replacement in Windows 11

Microsoft began automatically replacing expiring Secure Boot certificates on eligible Windows 11 24H2 and 25H2 devices via Windows quality updates, using a phased rollout that targets “high-confidence” devices based on successful update signals. The change follows earlier warnings that commonly used Secure Boot trust anchors will start expiring in June 2026, which could disrupt secure boot validation on UEFI systems if not remediated. Secure Boot relies on firmware-stored certificates to verify bootloader signatures and prevent pre-boot malware (e.g., rootkits) from loading.

Microsoft warned that failing to update these certificates can lead to loss of Windows Boot Manager trust and Secure Boot protections, and may prevent devices from receiving future security updates for pre-boot components—creating both availability and security risk. For organizations that need tighter control, Microsoft also provides manual deployment options (e.g., via registry-based methods and enterprise management tooling such as policy/configuration controls) to ensure certificate updates are applied ahead of expiration and to validate Secure Boot status across fleets.