Blog Post

Windows IT Pro Blog
7 MIN READ

Act now: Secure Boot certificates expire in June 2026

Ashis_Chatterjee's avatar
Ashis_Chatterjee
Icon for Microsoft rankMicrosoft
Jun 26, 2025
Prepare for the first global large-scale certificate update to Secure Boot. The Microsoft certificates used in Secure Boot are the basis of trust for operating system security, and all will be expi...
Updated Jul 08, 2025
Version 3.0
security
servicing and updates
windows 10
windows 11
Simon_Aebi's avatar
Simon_Aebi
Copper Contributor
Jul 09, 2025

I’m somewhat happy to see that many of the manual steps from 5025885 to fix BlackLotus will now be deployed by Microsoft through updates.

As I understand it, everything should happen automatically if telemetry data is set to "required" and the devices are managed by Intune. It’s not explicitly mentioned, but I assume that since Autopatch is included, Intune will be as well.

Or am I misunderstanding, and there are still manual steps required to address the BlackLotus CVE?