Event details

It's time for our third Ask Microsoft Anything (AMA) about updating Secure Boot certificates on your Windows devices before they expire in June of 2026. If you've already bookmarked Secure Boot playb...
Pearl-Angeles
Updated Mar 11, 2026
AMA
DJ8014A's avatar
DJ8014A
Copper Contributor
Mar 13, 2026

And yes I believe it did update the signed boot manager. Does that do us any good without the KEK?

mihi's avatar
mihi
Brass Contributor
Mar 13, 2026

The signed boot manager does not require the KEK to be updated, as the 2023 DB updates are signed with the 2011 KEK.

 

Only the next boot manager certificates (in 2038) will require the 2023 KEK to be present (if the device still works by then).