The Secure Boot refresh is one of the largest coordinated security maintenance efforts across the Windows ecosystem, Microsoft said. In other words, update those PCs soon.
The original Unified Extensible Firmware Interface (UEFI) Secure Boot certificates for Windows will start expiring in late June. Microsoft has urged IT and security leaders to apply updated certificates to all Windows PCs made before 2024 to ensure they continue receiving security updates.
Microsoft added Secure Boot to Windows nearly 15 years ago as a feature of UEFI software, which starts a PC before Windows launches. Secure Boot checks that only properly signed and approved firmware, such as operating system loaders, device drivers, and boot servers, is loaded at startup. Because it acts as the hardware-based root of trust for the computer, Microsoft refers to it as the Windows operating system's "foundational trust anchor."
To further guard against UEFI Bootkits — a type of highly privileged malware, such as BlackLotus, FinSpy and MoonBounce — Secure Boot loads before the operating system bootloader. This process prevents malicious software from loading at startup, before the operating system starts.
"It verifies the cryptographic signatures of boot components against a database of authorized keys, blocking unauthorized or tampered software to protect system integrity from the earliest stages of boot," wrote Richard Hicks, president of Richard M. Hicks Consulting, based in Rancho Santa Margarita, Calif.
Additionally, all PCs designed for Windows 10 and Windows 11 include Secure Boot support. These devices originally shipped with the 2011 Microsoft Secure Boot certificates, while newer ones manufactured in the past two years have the updated 2023 certificates. Older systems configured for automatic patching — typically those that are personally owned or used by small businesses — are most likely using the updated 2023 certificates.
In enterprise environments, however, Windows updates are usually not automated. Instead, they are applied in a staged manner to maintain system and application stability. While the new Secure Boot 2023 update does not introduce major feature changes, Microsoft says the new certificates improve the root of trust and allocates tasks more efficiently.
The new certificates also use cryptographic tools to sign software and last longer, which Microsoft says provides improved certificate authority (CA) segmentation. This was designed to let Microsoft and PC manufacturers continue securely updating and monitoring the boot process.
Nuno Costa, a program manager on Microsoft's Windows service delivery team, recently described the Secure Boot refresh as one of the largest coordinated security maintenance efforts across the Windows ecosystem.
"The Secure Boot certificate update marks a generational refresh of the trust foundation that modern PCs rely on at startup," Costa wrote in a blog post.
Organizations should act now to update Secure Boot certificates on all endpoints, Hicks says.
"If the Microsoft UEFI Secure Boot certificate expires, endpoints are vulnerable to potential future threats, as updates to the UEFI databases (DB and DBX) will fail," he warns.
To ease this transition, Microsoft this month began releasing a new indicator in the Windows Security app to help monitor device security. This indicator displays the status of a PC's Secure Boot certificate. In Windows, users with administrator access can see whether the operating system has the updated certificate under Device Security > Secure Boot. Microsoft will also add a feature next month to provide notifications and directions.
Hicks says that will be helpful, especially for consumers and small business users.
"There's been a lot of confusion to this point about which systems are up to date and which are not," he says. “The verification checks involved looking at registry keys or using tools like my Get-UEFICertificate PowerShell script to validate Secure Boot certificate updates. Having a clear, simple visual cue in the UI eliminates any ambiguity about the update status.”
It is also important to note that while mainstream support for Windows 10 ended last fall, Windows 10 devices in Microsoft’s Extended Security Update (ESU) program — a paid service that provides security updates for unsupported versions — will still get the new Secure Boot certificates. These certificates help ensure that a computer boots only trusted software. However, Windows 10 PCs not in the ESU program won’t automatically get the certificates. As the older 2011 certs expire, these PCs will gradually lose the ability to use Secure Boot.
Microsoft urges CISOs and administrators to immediately consult its playbook for preparing for the Secure Boot 2011 certificate expiration, conduct a thorough inventory, review deployment steps, and confirm OEM firmware prerequisites. Another tip: Ask questions and take steps now to ensure ongoing security.
The original Unified Extensible Firmware Interface (UEFI) Secure Boot certificates for Windows will start expiring in late June. Microsoft has urged IT and security leaders to apply updated certificates to all Windows PCs made before 2024 to ensure they continue receiving security updates.
Microsoft added Secure Boot to Windows nearly 15 years ago as a feature of UEFI software, which starts a PC before Windows launches. Secure Boot checks that only properly signed and approved firmware, such as operating system loaders, device drivers, and boot servers, is loaded at startup. Because it acts as the hardware-based root of trust for the computer, Microsoft refers to it as the Windows operating system's "foundational trust anchor."
To further guard against UEFI Bootkits — a type of highly privileged malware, such as BlackLotus, FinSpy and MoonBounce — Secure Boot loads before the operating system bootloader. This process prevents malicious software from loading at startup, before the operating system starts.
"It verifies the cryptographic signatures of boot components against a database of authorized keys, blocking unauthorized or tampered software to protect system integrity from the earliest stages of boot," wrote Richard Hicks, president of Richard M. Hicks Consulting, based in Rancho Santa Margarita, Calif.
Additionally, all PCs designed for Windows 10 and Windows 11 include Secure Boot support. These devices originally shipped with the 2011 Microsoft Secure Boot certificates, while newer ones manufactured in the past two years have the updated 2023 certificates. Older systems configured for automatic patching — typically those that are personally owned or used by small businesses — are most likely using the updated 2023 certificates.
In enterprise environments, however, Windows updates are usually not automated. Instead, they are applied in a staged manner to maintain system and application stability. While the new Secure Boot 2023 update does not introduce major feature changes, Microsoft says the new certificates improve the root of trust and allocates tasks more efficiently.
The new certificates also use cryptographic tools to sign software and last longer, which Microsoft says provides improved certificate authority (CA) segmentation. This was designed to let Microsoft and PC manufacturers continue securely updating and monitoring the boot process.
Nuno Costa, a program manager on Microsoft's Windows service delivery team, recently described the Secure Boot refresh as one of the largest coordinated security maintenance efforts across the Windows ecosystem.
"The Secure Boot certificate update marks a generational refresh of the trust foundation that modern PCs rely on at startup," Costa wrote in a blog post.
Missing the Deadline
To ensure systems remain protected, Microsoft recommends prioritizing the update of Secure Boot certificates before their June 24 expiration. While PCs will continue to function even with the original certificates, failing to update means missing critical security enhancements that Microsoft will no longer provide.Organizations should act now to update Secure Boot certificates on all endpoints, Hicks says.
"If the Microsoft UEFI Secure Boot certificate expires, endpoints are vulnerable to potential future threats, as updates to the UEFI databases (DB and DBX) will fail," he warns.
To ease this transition, Microsoft this month began releasing a new indicator in the Windows Security app to help monitor device security. This indicator displays the status of a PC's Secure Boot certificate. In Windows, users with administrator access can see whether the operating system has the updated certificate under Device Security > Secure Boot. Microsoft will also add a feature next month to provide notifications and directions.
Hicks says that will be helpful, especially for consumers and small business users.
"There's been a lot of confusion to this point about which systems are up to date and which are not," he says. “The verification checks involved looking at registry keys or using tools like my Get-UEFICertificate PowerShell script to validate Secure Boot certificate updates. Having a clear, simple visual cue in the UI eliminates any ambiguity about the update status.”
It is also important to note that while mainstream support for Windows 10 ended last fall, Windows 10 devices in Microsoft’s Extended Security Update (ESU) program — a paid service that provides security updates for unsupported versions — will still get the new Secure Boot certificates. These certificates help ensure that a computer boots only trusted software. However, Windows 10 PCs not in the ESU program won’t automatically get the certificates. As the older 2011 certs expire, these PCs will gradually lose the ability to use Secure Boot.
Microsoft urges CISOs and administrators to immediately consult its playbook for preparing for the Secure Boot 2011 certificate expiration, conduct a thorough inventory, review deployment steps, and confirm OEM firmware prerequisites. Another tip: Ask questions and take steps now to ensure ongoing security.