Windows Secure Boot certificates expire on 26 June 2026. Is your PC ready?

If you've seen headlines about Windows Secure Boot certificates expiring and wondered whether your PC is about to stop working: it isn't. But there is something you should check, and the deadline is 26 June.

Here's what's actually going on, stripped of the panic.

What Secure Boot does

When you turn your PC on, Secure Boot checks that every piece of software loading before Windows is legitimate and hasn't been tampered with. It's a layer of protection that runs before Windows itself, before your antivirus, before anything you'd normally interact with. If malware tries to inject itself into the boot process, Secure Boot blocks it.

It works using digital certificates. Think of them like an ID badge that Windows shows to your PC's firmware: "I'm the real Windows, let me through." Those certificates have expiry dates, and the ones currently in use expire between 24 and 26 June 2026.

What happens on 27 June

Nothing dramatic. Your PC will turn on. Windows will load. Everything works exactly as it did the day before.

What changes is behind the scenes. PCs still running the old certificates won't be able to accept new boot-level security updates going forward. Microsoft can't sign new boot components with an expired certificate, so your Secure Boot protection gradually falls behind. It doesn't break. It just stops getting better.

Over months, that gap widens. Not a crisis in July. Worth sorting before Christmas.

Are you already covered?

Probably. Microsoft has been rolling out replacement certificates (the "Windows UEFI CA 2023" set) through ordinary Windows updates since late 2024. If your PC is reasonably up to date, the new certificates are likely already installed and you don't need to do anything.

The people at risk are those who:

• Haven't installed Windows updates in a long time (months, not days)
• Have paused updates indefinitely
• Are running an old Windows 10 installation that hasn't been updated since before the Extended Security Update programme started
• Built their own PC and disabled Secure Boot in BIOS at some point

How to check (takes 30 seconds)

1. Press Windows + R on your keyboard. A small "Run" box appears in the corner.
2. Type msinfo32 and press Enter. A window called "System Information" opens.
3. In the right-hand panel, look for Secure Boot State. It should say On.

If it says On, your PC has Secure Boot active and is receiving the certificate updates through normal Windows Update. Make sure you're current on updates (Settings > Windows Update > Check for updates) and you're sorted.

If it says Off or Unsupported, the certificate expiry doesn't apply to you at all. Secure Boot isn't running, so the certificates aren't being used. Whether you should turn Secure Boot on is a separate conversation, but it won't affect you on 26 June either way.

Things not to do

I've already seen forum posts from people who went into BIOS and toggled Secure Boot off and back on "to refresh it." Don't do that. Cycling Secure Boot can reset the certificate database and undo the update Microsoft already pushed. It creates the problem you were trying to prevent.

Similarly, don't go looking for certificates to download manually from Microsoft's website. The update comes through Windows Update automatically. Manual certificate installation is an IT administrator task for managed fleets, not something home users need to touch.

What about Windows 10?

Windows 10 reached end of support in October 2025. If you're still on Windows 10 without the paid Extended Security Update subscription, you stopped receiving updates months ago, including the certificate rollout. The Secure Boot certificates on your machine are the old ones and will expire in June.

In practice, this is one more reason on the pile to think about upgrading to Windows 11 or replacing the PC. If the machine can't run Windows 11 (the hardware requirements are strict), it's probably old enough that a replacement makes more sense than paying for ESU.

I've written about the Windows 10 situation separately: Windows 10 end of life: what are your options?

Do I need to worry?

If you've read this far and your PC is up to date, no. The certificate rollout has been happening quietly in the background for over a year. Most PCs picked it up without their owners noticing, which is exactly how it should work.

The 26 June date is getting attention because it sounds scary. Certificates expiring. Security deadlines. But for most people with a normally-updated Windows 11 PC, there is genuinely nothing to do. Check msinfo32 if you want peace of mind. Then forget about it.

If you're not sure whether your PC is up to date, or you've had problems with Windows updates recently (the May 2026 update had a few issues), it's worth getting it checked over before the deadline rather than after. A quick health check takes half an hour and means you're not scrambling in July wondering why something stopped working.

If you're in St Helens and want someone to check your PC is ready, drop me a message.

Mark

Mark has been fixing computers since the late '90s and went self-employed in 2008. Based in St Helens since 2013, he works evenings and weekends from his home in Laffak — friendly, affordable repairs for PCs, laptops, and Macs. See reviews on Google