- The secure boot certificates originally issued in 2011 will soon expire, which could leave the system vulnerable.
- Microsoft distributes updates automatically via Windows Update, although some older computers require manual intervention.
- The Windows Security application will implement a color system to alert about the status of these updates.
If you like to keep your computer up-to-date and running smoothly, you've probably noticed that Microsoft has raised concerns about a technical issue that might sound trivial, but is vital for your computer's security . It turns out that some digital certificates—those that confirm "yes, this file is safe and comes from Microsoft"—are about to expire, and if they aren't renewed, you could find that Windows Update stops working or that your PC is vulnerable to serious attacks.
The main change involves Secure Boot , a feature that essentially prevents malware from infiltrating the system before Windows even starts loading. For those with older computers, the 2011 certificates will no longer be valid, so you'll need to upgrade to the 2023 version. Don't worry, most systems update automatically , but there are cases where you'll need to manually configure the system to prevent it from crashing.
The Windows Security Traffic Light
To make things easier for us, even if we're not computer experts, Microsoft is integrating a very intuitive visual icon system into the Windows Security app (within Device Security > Secure Boot) . Basically, it will work like a traffic light, letting us know if we're safe or if we need to take action.
- Green icon: Everything is going smoothly. The equipment is protected and you don't have to lift a finger.
- Yellow icon: There is a security recommendation. There may be a hardware or firmware limitation that is present. blocking the update automatically.
- Red icon: Immediate attention is required. There is a vulnerability or the certificate has expired, which requires you to take action right away.
Starting in May 2026, you'll likely see more direct alerts outside the app, such as system notifications, so you don't miss the fact that Secure Boot needs attention. If you see the yellow or red icon, you can dismiss the warning if you're an administrator, although this doesn't fix the underlying problem; it only hides the notification.
How to tell if your PC is up to date
If you don't want to wait for the traffic light to warn you, there are ways to check it right now. For the bravest among you who aren't afraid to open a console, there's a command to PowerShell run as administrator which gives you the answer in black and white: ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFIdb).bytes) -match 'Windows UEFI CA 2023')If the system responds TrueYou can go to sleep peacefully; if it comes out "false"Your certificates will expire and action will have to be taken.
Another more traditional way is to enter the Certificate Manager typing certmgr.msc In the search engine. There, in the "Trusted Root Certification Authorities" folder, you can search for those issued by Microsoft and verify that the expiration dates They must not have expired. If you notice something is amiss or receive warnings in browsers like Chrome or Edge, it's a clear sign that the root certificate list hasn't been updated correctly.
Step-by-step guide to troubleshooting certificate issues
If you've discovered your computer isn't up to date, don't panic. There are several ways to fix it, depending on how urgent your situation is and how your PC is configured. The first and easiest step is to go to Settings > Windows Update and force a search for updates . Be sure to also check the "Optional updates," as this is where the necessary drivers and firmware patches are often hidden.
If Windows Update doesn't find anything but you know you need the patch, you can try running a registry command to force updates to become available: reg add HKLM\\System\\CurrentControlSet\\Control\\Secureboot /vAvailableUpdates /t REG_DWORD /d 0x5944 /fFurthermore, it is essential that the Secure Boot is enabled in the BIOS/UEFI of your motherboard, because if it is turned off, the update has nowhere to be installed.
For those managing enterprise networks with WSUS or SCCM , the risk is greater because an expired certificate on the server can block patching for the entire office. Administrators must distribute certificate packages manually and monitor compliance reports to prevent isolated machines from becoming vulnerable. In extreme cases, if the system continues to fail, running tools like SFC /scannow and DISM can help repair corrupted files that are preventing the correct installation of new certificates.
Consequences of keeping obsolete certificates
You might think "it doesn't matter" and keep using your PC, but the risk is real. If the certificates expire, Windows Update may stop downloading critical security patches, exposing you to vulnerabilities that have already been fixed for everyone else. In the worst-case scenario, you could experience compatibility issues where the operating system or firmware doesn't load correctly at startup.
This is especially critical for devices manufactured before 2024, as these rely entirely on firmware updates. If the manufacturer (Dell, HP, Lenovo, etc.) has released a specific BIOS update , it is highly recommended to install it, as this is usually the cleanest way to renew the secure boot trust keys.
Keeping your system up to date isn't just about having the latest features; it's about ensuring your PC's security is secure. Whether you check the Windows Security Traffic Light, run PowerShell commands, or force Windows Update, the important thing is to avoid letting 2011 certificates expire without migrating to the 2023 version. This will prevent your computer from becoming unprotected or losing essential technical support.