Event details

Have questions about how device manufacturers support the Secure Boot certificate update process? Join OEM Secure Boot Office Hours to connect directly with OEMs and get answers to your questions. Th...
Heather_Poulsen
Updated Jul 15, 2026
Office Hours
Swartz99's avatar
Swartz99
Tin Contributor
Jul 15, 2026

Any OEM, is there going to be a date where a device that still has 2011 certs will never be able to update to the 2023 certs? 

Dan_Pandre's avatar
Dan_Pandre
Icon for Microsoft rankMicrosoft
Jul 15, 2026

Answer for Surface: Every model which is currently eligible for an update will still be eligible for it later, and Windows Update is the easiest way to get these KEK updates. A more involved process is also documented at https://support.microsoft.com/en-US/surface/drivers-firmware/surface-secure-boot-certificates

Surface models that originally launched with Windows 8 are not eligible. This means Surface Pro 3, Surface 3, and older devices.

Surface models that launched in 2024 or later do not need these updates and shipped with the 2023 certificates already present.