Blog Post

Windows IT Pro Blog
5 MIN READ

Best practices for deploying Secure Boot certificate updates

Nuno_Costa's avatar
Nuno_Costa
Icon for Microsoft rankMicrosoft
Jun 23, 2026
Deploying Secure Boot certificate updates across the Windows ecosystem has required coordination across operating systems, device manufacturers, and firmware vendors. The steady and coordinated rollo...
Updated Jun 23, 2026
Version 1.0
device management
security
servicing and updates
tips and tricks
JamesEpp's avatar
JamesEpp
Iron Contributor
Aug 12, 2026

This isn't a rhetorical question.

MSFT made new keys in 2023 to replace keys that are expiring in 2026.

That gave three years to do a rekey across the entire ecosystem.

 

These new keys expire in 2035 or 2038, depending on which one you're looking at.

I think we can agree 3 years was cutting it a bit close. When does MSFT plan to rekey these newest/active certificates?