Blog Post

Windows IT Pro Blog
8 MIN READ

Secure Boot playbook for certificates expiring in 2026

Ashis_Chatterjee's avatar
Ashis_Chatterjee
Icon for Microsoft rankMicrosoft
Nov 13, 2025
The first set of tools and steps are now available to help you proactively update your Secure Boot certificates before they expire in June of 2026. Secure Boot is more mature and robust today than ...
Updated Nov 13, 2025
Version 5.0
servicing and updates
Brent-H's avatar
Brent-H
Brass Contributor
Nov 14, 2025

Is there anything specific for Hyper-V VMs (e.g. something needs to be changed on the VM settings)?

I set the registry key on a server 2022 VM (running on server 2022 host, both with the November CU) and it now shows WindowsUEFICA2023Capable = 2 , UEFICA2023Status = InProgress, and UEFICA2023Error = 80070013. 

 

In the event viewer, event 1795 says (I excluded the bucket ID lines):

The system firmware returned an error The media is write protected. when attempting to update a Secure Boot variable 4. This device signature information is included here.
DeviceAttributes: FirmwareManufacturer:Microsoft Corporation;FirmwareVersion:Hyper-V UEFI Release v4.1;OEMModelNumber:Virtual Machine;OEMManufacturerName:Microsoft Corporation;OSArchitecture:amd64;

In the VM's settings on the host, the secure boot template is set to "Microsoft Windows" (the other options are Microsoft UEFI Certificate Authority and Open Source Shielded VM).