This has never happened before. Microsoft is expiring the authentication that protects Windows PCs from threats each time they restart. Secure Boot certificates on almost all Windows PCs date back to 2011 and will now be replaced. The process starts this month and is wrapped into April’s security update.
While Microsoft had said that “starting in April 2026,” PCs users will be able to check to confirm the update has installed successfully, that advice has now been updated. The status check “won’t show up immediately on all PCs,” the company now says, but the update will be available “by the end of April 2026.”
The update both installs new certificates and confirms whether user action is required. When you go to Windows Security > Device security > Secure Boot, Microsoft tells PC owners that, “a green, yellow, or red badge attached to the Secure Boot icon indicates your current Secure Boot status.” You’re looking for a red icon indicating that “something that needs your immediate attention.”
The new, updated advice comes via Windows Latest, which explains that “Secure Boot certificates are used to validate boot software, and if they are expired, your computer could be exposed to boot-level malware (bootkits) or unauthorized modifications in the worst-case scenario.”
While the timeline for Secure Boot certificate expiry has been available from Microsoft for some time, “the catch is that Secure Boot status has mostly been unclear to regular users.” And while including new security certificates in the standard monthly update “sounds like a good plan,” most users are unaware.
“You can verify whether the Secure Boot 2023 certificate is applied to your computer using PowerShell commands or Event Viewer logs,” Windows Latest says, “but you can’t expect a regular user to be familiar with that process, which is why Microsoft is finally adding Secure Boot certificate status to Windows Security.”
Put simply, don’t panic if you don’t have the update — certificates don’t expire for several more weeks, Just make sure you check and update by the end of the month so as not to forget. If you do need to take action, you should give yourself time.
By the end of April, the updated verification should be “visible under the “Secure Boot” section under the ‘Device Security‘ tab in Windows Security.”
“Previously, the Secure Boot and Device security icon badges and accompanying text guidance only reflected whether Secure Boot was enabled or disabled,” Microsoft explains in its revised support document. “Now, we’re enhancing the badges and text guidance to also show Secure Boot certificate update status.”
