A Ticking Clock on Millions of PCs
Microsoft has issued an advisory warning that critical Secure Boot certificates used by Windows PCs are scheduled to expire in June 2026, an event that could potentially prevent affected computers from booting properly if the certificates are not updated before the expiration date. The advisory, published through Microsoft's Security Response Center, details the scope of the issue, identifies which systems are at risk, and provides guidance on how both individual users and enterprise IT administrators can prepare for and address the certificate transition.
Secure Boot is a security feature built into the UEFI firmware of modern PCs that ensures only trusted, digitally signed software can execute during the boot process. When a computer starts up, the firmware checks the digital signature of the bootloader and operating system kernel against a database of trusted certificates stored in the system's firmware. If the signatures do not match a trusted certificate, the system refuses to boot, preventing malware from hijacking the startup process.
What Is Actually Expiring
The certificates at risk are the Microsoft Windows Production PCA certificates that were originally issued in 2011 and have a 15-year validity period. These certificates are part of the chain of trust that validates the digital signatures on Windows bootloaders. When they expire, the firmware's signature verification will fail for bootloaders signed with these certificates, potentially rendering the system unable to load Windows.
The affected certificates are embedded in the UEFI firmware of PCs manufactured between approximately 2012 and 2024. The exact impact depends on several factors, including the firmware version, the manufacturer's implementation of Secure Boot, and whether the system has received firmware updates that include replacement certificates.
Which Systems Are At Risk
The scope of potentially affected systems is substantial:
- Consumer PCs: Any Windows PC manufactured in the affected timeframe that has not received a firmware update containing the new certificates. This includes desktops, laptops, tablets, and convertible devices from all major manufacturers.
- Enterprise systems: Business-class workstations, servers, and point-of-sale systems that use Secure Boot with the expiring certificates. Enterprise environments are particularly vulnerable because firmware updates are often deferred due to compatibility testing requirements.
- Virtual machines: Some virtualization platforms, including Microsoft's own Hyper-V, use Secure Boot certificates that may be affected. Virtual machines running on these platforms could also experience boot failures.
- Custom and embedded systems: Industrial PCs, kiosks, medical devices, and other embedded Windows systems that rarely receive firmware updates and may be running outdated certificate databases.
