Microsoft is launching a massive industry-wide effort to refresh Secure Boot Certificates on millions of Windows PCs before the original certificates expire in June 2026. The Unified Extensible Firmware Interface (UEFI) certificates, introduced in 2011, are reaching the end of their lifecycle and require replacement to maintain system security. This rollout involves collaboration across the entire Windows ecosystem, including OEMs, firmware makers, and hardware partners.

According to Microsoft's latest Windows Blog, the company has been working with OEMs to provision updated certificates on newer devices, with most 2025 models and some 2024 devices already supporting the new certificates. Older PCs shipped before these years will also receive updates through their respective manufacturers. The process requires UEFI BIOS patches from firmware makers to replace aging certificates, representing one of the largest coordinated security efforts in the Windows ecosystem's history.

While systems without the updated certificate will continue to function normally for now, Microsoft warns this creates a degraded security state vulnerable to boot-level exploits. Without new certificates, PCs may face compatibility issues with future hardware, software, and firmware that depend on Secure Boot verification. Users should check with their OEM for update availability, as the rollout is happening gradually across different device manufacturers and models.