Windows Secure Boot certificates set to expire in June — here's what it means for your PC

Microsoft is replacing expiring 2011 Secure Boot certificates on Windows PCs with new UEFI CA 2023 keys.

Supported devices are getting the update through Windows Update, and already-updated PCs should keep working normally.

Older systems may need OEM firmware updates to stay protected, while legacy BIOS machines are not affected because they do not use Secure Boot.

If eligible PCs miss the new certificates or firmware updates, they can still run Windows but lose some early-boot malware defenses.