Secure Boot Certificate Expiration 2026: What IT Pros Need to Do
Three Microsoft Secure Boot certificates that have been baked into device firmware since around 2012 are expiring this year. Devices that don't get updated before the deadlines will keep booting normally, but they lose the ability to receive any future boot-level security content: DBX revocations, Boot Manager updates, and protections against firmware exploits like BlackLotus. The UEFI CA 2011 certificate also covers Option ROMs for add-in cards including NVIDIA and AMD GPUs, so systems with discrete GPUs that miss the update may fail to validate GOP firmware at boot after June 2026.