Microsoft warns of 2026 Secure Boot certificate expiry that may affect older PCs

Microsoft has issued a broad alert that a set of Secure Boot trust certificates will reach end-of-life in 2026, creating a practical deadline for firmware and platform updates. The certificates form part of the cryptographic chain used at system startup to validate OS and driver signatures; when those credentials expire, systems that depend on them can no longer verify new signed images unless replacement certificates are installed. Microsoft and major OEMs have cataloged which models and firmware revisions already include the refreshed credentials and which will need an update, and many devices manufactured in the most recent windows-era shipments already carry the new trust anchors. Administrators can inspect firmware settings to determine whether a system’s default certificate store contains the updated keys, a distinction that determines whether a simple BIOS reset will affect boot validation. For devices that lack the new certificates baked into firmware, vendors are offering BIOS updates or packaged delivery through system management utilities and Windows Update channels. Home users who cannot apply firmware revisions are being directed to vendor support and Microsoft customer service for remediation guidance. From an operational perspective, enterprises must treat the upcoming expiry as a scheduled infrastructure risk: unmanaged endpoints, remote workers, and legacy fleet segments are the most exposed. The technical remediation pathway is straightforward in principle—deploy updated firmware or install replacement certificate entries—but scale and validation across heterogeneous inventories are nontrivial. Organizations should inventory devices, test updates in controlled groups, and adjust imaging and deployment pipelines to include the new trust material. Failure to plan could produce uneven availability as some machines reject newer platform code or updates after the expiration threshold. The window for safe, automated remediation exists now, but it narrows as the expiry date approaches and as supply-chain or IT bandwidth constraints slow rollouts. Ultimately, the episode underlines that foundational cryptographic elements of modern PCs require lifecycle management similar to software patches: they must be tracked, tested, and refreshed before they expire to preserve seamless operation.