Secure Boot Certificate Changes in 2026: Is Your PC Ready?

Microsoft is replacing ageing Secure Boot certificates used by Windows computers, and the change is becoming an important maintenance issue in 2026.

The original certificates began reaching expiry dates from June 2026. Microsoft has expanded the rollout of replacement certificates to eligible devices through Windows updates.

For most people, certificate expiry does not mean that a computer will immediately refuse to start. However, devices that fail to receive the new certificates may eventually miss important protections and future boot-related security updates.

What is Secure Boot?

Secure Boot is a security feature built into modern computer firmware. It helps verify that trusted software is loading when the PC starts.

This makes it harder for malicious software to insert itself before Windows and evade ordinary antivirus protection. Threats operating at this level can be particularly difficult to detect and remove because they begin running before many operating-system security controls.

Secure Boot works with digital certificates that identify trusted boot components. Those certificates cannot remain unchanged forever, which is why Microsoft and computer manufacturers must transition devices to newer versions.

Will affected computers stop working?

In most cases, no immediate failure is expected solely because an older certificate reaches its expiry date.

The greater concern is that an unmanaged or unhealthy computer may not receive the new certificate. Over time, that device could lack support for newer boot managers, revocation information and Secure Boot security improvements.

This is especially relevant to computers with:

• Windows updates disabled or repeatedly failing
• Very old BIOS or UEFI firmware
• Secure Boot disabled
• Unusual boot configurations
• Unsupported operating systems
• Long periods without internet access
• BitLocker enabled without securely stored recovery keys

Some devices may restart an additional time while the certificate update is applied. A restart during maintenance should not automatically be treated as a hardware fault.

Why businesses should take extra care

Firmware and boot-security changes require more caution than an ordinary application update.

If BitLocker protects the drive, a firmware or security change may occasionally cause Windows to request the recovery key. The key should therefore be verified and securely recorded before major firmware maintenance.

Businesses should not discover during an urgent support call that nobody knows which Microsoft account or administrator profile holds the key.

A managed health check should review the complete chain rather than only asking whether Secure Boot displays “On.” Relevant checks include:

• Windows edition, version and update status
• Secure Boot capability and current state
• TPM status
• BIOS or UEFI version
• BitLocker encryption status
• Recovery-key availability
• Manufacturer firmware updates
• Evidence that replacement certificates were deployed

Avoid changing firmware settings blindly

Users may find internet instructions telling them to enable Secure Boot, reset keys or change legacy boot settings. Applying these steps without checking the current configuration can leave a machine unable to boot.

Older installations may use legacy BIOS mode or an incompatible disk layout. The correct remediation may require preparation inside Windows before firmware settings are changed.

For business computers, servers and Hyper-V hosts, changes should be planned, documented and tested.

Add Secure Boot to routine maintenance

The 2026 certificate transition is a useful reminder that computer security extends beyond antivirus software. Firmware, encryption, recovery keys and operating-system updates all contribute to whether a device can be trusted and recovered.

RandTech IT can inspect Windows update health, BIOS firmware, TPM, Secure Boot and BitLocker recovery readiness as part of a structured business PC health check.

If your organisation has older PCs, manually configured machines or devices that frequently fail updates, arrange an assessment before a security maintenance issue becomes an outage.

Source: Microsoft’s Secure Boot certificate-expiry guidance