Microsoft is rolling out critical Secure Boot certificate updates through Windows Update ahead of a major expiration deadline. The current certificates, issued in 2011, will expire in late June 2026, potentially leaving devices vulnerable to boot-level exploits. Starting in April 2026, Windows Security will display a color-coded badge system showing whether devices have the latest certificates installed.

A green checkmark indicates full protection, while a yellow caution badge appearing in May 2026 signals pending updates or hardware limitations. The most serious red stop icon could appear by June 2026 when older certificates expire, preventing critical boot-level security updates. This status is also visible in the Windows Security system tray icon for constant monitoring.

Most 2025 devices are already covered, with 2024 hardware largely addressed as well. Older machines will receive gradual updates, with major OEMs providing firmware guidance. Microsoft directs users to aka.ms/getsecureboot for assistance. While dismissing warnings is technically possible, Microsoft strongly advises against it since devices without updated certificates face degraded security and potential incompatibility with future Windows security patches.