Modern PCs support the Windows Secure Boot feature via their UEFI firmware. This ensures that the computer blocks malware, such as rootkits, even before the operating system starts. The Secure Boot function uses keys, certificates, and signature databases to ensure the integrity of the boot components.
The certificates used to date date back to 2011 and were due to expire in June 2026. The new certificates have been rolling out since 2023, and the update is applied automatically either via a firmware update or via Windows Update. You can check whether the update has been successful using the Windows Security app.
Open the Windows “Settings” from the Start menu, then click on “Privacy & Security > Windows Security > Open Windows Security.” Click on “Device Security” and please read the information under “Secure Boot.” If it says: “Secure Boot is enabled, and all required certificate updates have been applied.”
Foundry
No further certificate changes are required,” everything is fine. The certificates are up to date. However, if you see the message: “Secure Boot is enabled, preventing malicious software from loading when your device starts up,” the certificates have not been renewed.
In this case, check for an update for your UEFI firmware and ensure you have installed all available Windows updates. As of April 2026, the message may appear in either Windows 11 or Windows 10.