Windows’ original Secure Boot certificates expire in June—here’s what you need to do
The second thing to check is the “Default Database”, which indicates whether the new Secure Boot certificates are built into your PC’s firmware. If this is the case, even resetting the Secure Boot settings to default values in your PC’s BIOS will still allow you to boot operating systems that use the new certificates.
To check this, open PowerShell or Terminal again and type ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbdefault).bytes) -match 'Windows UEFI CA 2023'). If this command returns “true”, your system is running an updated BIOS with the new embedded Secure Boot certificates. Older PCs and systems without a BIOS update installed will return “false” here.
Microsoft’s Costa says that “many newer PCs built since 2024, and almost all devices shipping in 2025, already include the certificates” and won’t need to be updated at all. And PCs several years older may be able to obtain the certificates via a BIOS update.
In the US, Dell, HP, Lenovo, and Microsoft all have lists of specific systems and firmware versions, while Asus provides more general information on how to obtain the new certificates via Windows Update, the MyAsus app, or the Asus website. The oldest PCs listed are typically from 2019 or 2020. If your PC came with Windows 11 out of the box, there should be a BIOS update with the new certificates available, although this may not be true for all systems meeting the Windows 11 upgrade requirements.
Microsoft encourages home users who cannot install the new certificates to use its customer support services to help. Detailed documentation is also available for IT shops and other large organizations that manage their own updates.
“The Secure Boot certificate update marks a generational refresh of the foundation of trust that modern PCs rely on when they boot,” Costa writes. “By renewing these certificates, the Windows ecosystem ensures that future innovations in hardware, firmware, and operating systems can continue to rely on a secure, industry-aligned boot process. »
