Event details

It's time for our third Ask Microsoft Anything (AMA) about updating Secure Boot certificates on your Windows devices before they expire in June of 2026. If you've already bookmarked Secure Boot playb...
Pearl-Angeles
Updated Mar 11, 2026
AMA
mataylor's avatar
mataylor
Occasional Reader
Mar 12, 2026

What impact will the TLS lifetime decreasing to 47 days have on these secure boot certificates?  Will these certificates eventually need to be replaced every 47 days?
https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-days

  • Jason_Sandys's avatar
    Jason_Sandys
    Icon for Microsoft rankMicrosoft
    Mar 12, 2026

    Hi mataylor​,

    These certificates are not TLS certificates and are not used for TLS and thus unrelated to this guidance from DigiCert.

  • JamesEpp's avatar
    JamesEpp
    Iron Contributor
    Mar 12, 2026

    My understanding is that all the UEFI certificate/keying is not subject to CA/Browser Forum baseline requirements. Heck, "expiration" seems to be more a suggestion from my understanding of these certificates, especially the PKs which come from the OEMs.