ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources, documents or advisories need attention: 272/272 feeds/APIs · 469/469 docs · 7/9 advisories · checked 14:23 UTC Customize Public modeDiscuss ChangeIntel on Discord
MC1237599 Stay informedMajor changeAdmin impact

Windows Server Secure Boot playbook for certificates expiring in 2026

From Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.
Windows
Microsoft 365 admin center

What the notice says

Microsoft’s text, safely structured

Learn about tools and options available to organizations to update Secure Boot certificates on Windows Server. Certificates begin expiring in June 2026. You must update them before that date to help keep your security posture. Many recent platforms already include the supported 2023 certificates in firmware. However, for the ones that need to be updated, you need to manage this process manually.

When will this happen

  • The tools are already available to help you to proactively inventory, monitor, and apply updated certificates to your Windows Server devices.
  • June 2026: The 2011 Secure Boot certificate authorities (CAs) begin expiring.

How this will affect your organization

Systems on the 2011 CAs after June 2026 are at risk of running on degraded security posture. To update these systems, please be proactive and follow our recommended approach.

What you need to do to prepare

Read complete guidance in Additional information for details on how to:

  1. Inventory and prepare your environment.
  2. Monitor and check your devices for Secure Boot status.
  3. Apply any needed OEM firmware updates before updating certificates.
  4. Plan and pilot Secure Boot certificate deployments.
  5. Troubleshoot issues.

Additional information

  • Get started today with the recommended approach in Windows Server Secure Boot playbook for certificates expiring in 2026.
  • Prepare your servers for Secure Boot certificate updates.
  • Join the online event Secure Boot certificate updates explained - Microsoft Technical Takeoff on March 9, 2026.
  • To manage Secure Boot certificate updates on Windows client, see Secure Boot playbook for certificates expiring in 2026.
  • For the latest information, bookmark https://aka.ms/GetSecureBoot as your landing page for resources to help you with Windows Secure Boot certificate updates.

What changed

Between archive captures, newest first

The archive supplies one version of this notice.

Learn more

Links from the notice and their documentation checks

No related evidence found in this installation's recent collection. This does not establish that no announcement exists.

Not confirmed here

What this page cannot tell you
  • Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
  • 1 linked page has not been read yet.
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 27 Oct 14:23 UTC · 272 of 272 readable · 270 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.