X-twitter Facebook-f Pinterest-p
X-twitter Facebook-f Pinterest-p

How to check your Windows PC for expiring security certificates – a big one ends in June


Microsoft gives Windows 10 its penultimate update but saves the best for Windows 11

Elyse Betters Picaro / ZDNET

Follow ZDNET: Add us as a preferred source on Google.

ZDNET’s key takeaways

  • Secure Boot protects modern Windows and Linux PCs.
  • Microsoft Secure Boot certificates from 2011 expire in June 2026.
  • Most PC owners are fine if they install the latest updates.

Last year’s end-of-support deadline for Windows 10 was a big test for consumers and IT pros alike. The good news is, everyone passed! The bad news is, there’s another crucial expiration date right around the corner.

Every Windows PC designed and built since 2011 supports a feature called Secure Boot. This feature, which is on by default on new PCs sold with Windows 10 and Windows 11, acts as a gatekeeper that allows only trusted software to run at startup. If someone tries to tamper with the operating system or boot from an alternate device, Secure Boot blocks that attempt.

Also: How to upgrade your ‘incompatible’ Windows 10 PC to Windows 11 – for free

All currently supported versions of Windows support Secure Boot, as do an increasing number of Linux distributions, including Ubuntu, Fedora, Linux Mint, OpenSUSE, and a host of others.

What’s happening to Secure Boot certificates?

Secure Boot relies on a chain of cryptographic certificates that verify each boot component’s signature. One of the most important certificates is the Key Exchange Key (KEK), which sits in the UEFI firmware and works with the Trusted Platform Module (TPM) to manage the list of trusted bootloaders, which are contained in the Allowed Signature Database (DB) and the Forbidden Signature Database (DBX). 

The Microsoft-issued Production Certificate Authority (CA) and UEFI CA certificates are also essential to the operation of Secure Boot and also need to be updated.

If you bought a PC in the last 15 years, it almost certainly contains Microsoft-issued KEK and UEFI CA certificates from 2011, which are slated to expire in June 2026. To update those certificates, you need access to the root of trust — the Platform Key, which is managed by the hardware OEM.

Also: After setting up Windows 11, these 9 steps are non-negotiable for me

When the Secure Boot certificates expire, they are no longer permitted to validate boot software. Your computer will still start and operate normally, but it will no longer be able to receive updates to Windows Boot Manager, Secure Boot databases and revocation lists, and fixes for newly discovered vulnerabilities in the boot chain. 

You can turn off Secure Boot, but doing so means you won’t be able to access disks that are encrypted using BitLocker without supplying the recovery key.

Microsoft points out that scenarios that rely on Secure Boot trust (such as BitLocker hardening, boot-level code integrity, or third-party bootloaders and Option ROMs) may also be affected if they require updated Secure Boot trust.

In 2023, Microsoft issued replacements for those Secure Boot certificates. But the whole point of the Secure Boot certificate model is that those certificates are not easy to replace — if they were, every malware developer in the world would be focusing energy on doing exactly that, creating malicious rootkits that run at startup and can’t be detected easily.

To prepare for this mass extinction event, Microsoft and its hardware partners have been working for several years, coordinating a global series of updates designed to replace those outdated certificates with the 2023 version. Microsoft has documented progress in a new blog post:

Our ecosystem partners play a critical role in the transition to the new Secure Boot certificates. OEMs have been provisioning updated certificates on new devices and many newer PCs built since 2024, and almost all the devices shipped in 2025 already include the certificates and require no action from customers. OEM partners have also worked closely with our engineering teams to ensure that in-market devices can apply the updates seamlessly and have provided their own guidance to help customers prepare for the transition. As a result of that concerted effort, you might soon see a firmware update that will bring your computer’s security core into the modern era, pushing the certificate expiration dates out by another decade or more.

For most people, this process should be unobtrusive. You might already have installed the necessary updates without realizing it.

For this post, I’ve assembled a list of frequently asked questions, along with authoritative answers.

Why are these certificates expiring?

Fifteen years is a long time! Security standards advance dramatically every year, and it’s normal to retire old certificates and replace them with newly issued certificates that meet modern security standards instead of becoming a point of vulnerability.

Does my PC have expiring Secure Boot certificates?

If your computer was designed and built after 2011, it includes Secure Boot certificates. Any device that was designed and built before 2024 probably has a 2011 certificate, which is about to expire.

According to Microsoft, its OEM partners have been provisioning updated certificates on new devices since 2024. If you have a relatively new device, it probably already includes the latest certificates. Copilot+ PCs built in 2025 or later already include the 2023 certificates and don’t need an update.

Also: My top six Windows 12 predictions – including its most likely release date

A recent Windows 11 update allows you to look in the Windows Security app to check the status of your security certificates. Choose the Device Security page and look under the “Secure boot” heading. If you see a message that says “all required certificates have been applied,” you’re good to go.

secure-boot-status-update

You can now use the Windows Security app to check the status of Secure Boot certificates.

Screenshot by Ed Bott/ZDNET

You can also use PowerShell to check whether your PC has the updated certificates. Open a PowerShell window using administrator credentials and then copy the following command and paste it at the PowerShell command line:

([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Windows UEFI CA 2023’)

If the response is True, you’re up to date. If the response is False, you need a firmware update.

Will I get an updated certificate automatically?

If your PC was designed and built by a major OEM (Lenovo, HP, Dell, ASUS, Surface), and you are running a supported Windows version, you should receive the necessary update automatically. 

According to Microsoft, “For most individuals and businesses that allow Microsoft to manage PC updates, the new certificates will be installed automatically through the regular monthly Windows update process, with no additional action required.” 

Also: Yes, you can get Microsoft 365 free – here’s how

Those updates will arrive on almost all PCs running Windows 11 and on PCs running Windows 10 with an Extended Security Updates subscription. You might need a separate firmware update from the PC maker to allow the updated certificates to install.

Each OEM has a status page where you can check for updated information.

A number of these manufacturers have been shipping PCs with both sets of certificates for some time, allowing enterprise customers to choose when to switch to the new certificates. 

For specialized computers, such as servers and IoT devices, you might need to download and install an update from the device maker.

What happens if I don’t update those certificates?

According to Microsoft, “When the 2011 CAs expire, Windows devices that do not have new 2023 certificates can no longer receive security fixes for pre-boot components, compromising Windows boot security…. Without updates, the Secure Boot-enabled Windows devices risk not receiving security updates or trusting new boot loaders, which will compromise both serviceability and security.”

I have a Mac. Do I need to worry about this?

No.

I have a PC running Linux. Do I need to worry about this?

If you’re dual-booting Linux with Windows, Microsoft says it will update the certificates that Linux relies on.

If you’ve wiped Windows completely, you might not get the latest security updates automatically. You can contact the company that built your PC to see if there’s a manual update, or you can turn Secure Boot off. Aside from seeing a scary red padlock on the boot screen, everything else will work as expected.

I built my own PC. Where are my updates?

Talk to the manufacturer of your motherboard. There might be an update, but depending on your PC’s age, the motherboard manufacturer might not offer one. You can turn off Secure Boot, and Windows will still start up. If BitLocker is enabled, you might need to provide the recovery key to access the data on that disk.

Also: How to find your BitLocker recovery key – and save a secure backup copy before it’s too late

When will the new certificates expire?

The 2023 certificates have expiration dates 15 years later, in 2038. The one exception is the Windows UEFI CA 2023, which will expire in June 2035. That means we’ll have to go through this dance again in less than a decade.

Where can I get more information or help?

The official Microsoft FAQ page is here: Secure Boot Certificate Update FAQ. If you run into issues on an unmanaged PC in a home or small office, check with the PC maker or contact Microsoft for support. Enterprise administrators can use commercial support channels.





Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Developer app design resources have been updated by Apple

First DORA Incident Report Highlights Growing ICT Resilience Risks

Oracle PeopleSoft RCE Flaw Used as Zero-Day in Ongoing ShinyHunters Campaign

21,786 Home Cameras, No Password, No Warning

I’m a lawn expert, and here’s my favorite trick for finding your perfect robot mower

First DORA Incident Report Highlights Growing ICT Resilience Risks

Oracle PeopleSoft RCE Flaw Used as Zero-Day in Ongoing ShinyHunters Campaign

21,786 Home Cameras, No Password, No Warning

Your old Android phone can replace a Roku or Fire Stick—here’s the setup I use

First DORA Incident Report Highlights Growing ICT Resilience Risks

Oracle PeopleSoft RCE Flaw Used as Zero-Day in Ongoing ShinyHunters Campaign

21,786 Home Cameras, No Password, No Warning

Recent Reviews

I’m a lawn expert, and here’s my favorite trick for finding your perfect robot mower


Robot mowers on a yard

Maria Diaz/ZDNET

Follow ZDNET: Add us as a preferred source on Google.

The perfect robot mower for you is not nearly as fancy and feature-heavy as you may think. I’ve said it before, and I’ll say it again: it’s not the lawn mower, it’s all about the yard. A robot mower may be a market leader with top-of-the-line specs and still not be a good fit for your yard.

Here’s the great news: There’s a perfect robot mower for almost any yard. As someone who’s tested numerous types of robot lawn mowers, I’ve learned that many of the specs that brands market as groundbreaking are simply not vital for most shoppers. A mostly flat, fenced-in 0.10-acre yard doesn’t need the power that a hilly, sectioned, unfenced one-acre yard does.

Also: I tested the Ferrari of robot mowers for a month – here’s my verdict

If you’re looking to choose the best mower for your home, be sure to check out ZDNET’s robot mower buying guide. 

Here’s what you don’t need to stress over when buying a robot mower

Eufy E15 Robot Mower

Maria Diaz/ZDNET
For yards with… Best robot mower type Examples
No fences A wired boundary is best, but a great GPS/RTK robot mower can stick to the map you make with it. Yardcare E400, Mammotion Luba 3
Fences A LiDAR robot mower that can be dropped to mow with little setup and learn its map as it navigates. Eufy E15, Ecovacs Goat A3000
A lot of trees A LiDAR or wired boundary mower, since trees can interfere with satellite signals. Husqvarna iQ series (optional wire, EPOS)
Unbordered garden beds A GPS/RTK robot mower that you can set up to avoid flower beds when mapping. Mammotion Luba 3, Husqvarna iQ Series
Bordered garden beds A LiDAR, GPS, or wired boundary robot mower works for these yards. If you choose a wired boundary, you may have to bury wire around the flower beds, unless the borders are tall enough for the mower to avoid. Mammotion Yuka, Navimow Series H
pets A LiDAR robot mower that can adjust its navigation in real-time in reaction to its surroundings. Mova LiDAX Ultra 2000, Segway Navimow i2
Hills and uneven terrain An AWD robot mower capable of handling steep slopes, regardless of the navigation type. Mammotion Luba 3, , Husqvarna iQ

1. Don’t focus on: ‘AI-powered’ or other marketing buzzwords

Segway Navimow X3 Series robot mower

Maria Diaz/ZDNET

Artificial intelligence (AI) has surpassed the popularity of acid-wash jeans in the 80s and Baby G watches in the early 2000s. And tech companies — including robot lawn mower manufacturers — are capitalizing on its appeal.

Most of these “AI-powered” or “intelligent mowing” terms are vague, geared to grab shoppers’ attention with buzzwords. That doesn’t mean that the robots don’t use AI to navigate, however. 

The key is to find out how the robot uses AI to its benefit, and whether that will meet your AI expectations. 

Also: This robot mower took care of my lawn for months – and it’s currently $300 off

AI algorithms typically process data captured by the robot’s hardware to help it make quick decisions and adjustments. For example, a robot lawn mower may have a set of sensors and cameras to capture its surroundings. The robot’s processor then uses AI to convert that information into actionable data, so it knows whether to swerve to avoid an obstacle or slow down around a retaining wall.

Instead, look for: The navigation tech under (and on) the hood

Instead of AI and other buzzwords, you should focus on matching the robot lawn mower’s hardware and navigation system to your yard. This includes whether the robot uses RTK (Real-Time Kinematic) for positioning, and whether it features LiDAR, cameras, and sensors. 

Then look at real user reviews to assess how accurately the robot mower maps and how well it performs around various types of obstacles.

There’s no blanket rule for robot mowers, but most do well with the following guidelines.

2. Don’t focus on: Premium extras

Yardcare E400 robot lawn mower

Maria Diaz/ZDNET

Skip the premium extras that don’t match your yard. You really don’t need the most advanced robot mower; you need the one that will best handle your lawn. 

Most US homeowners have mostly flat lawns, simple rectangular layouts, minimal obstacles, and small yards. Yet some of the most popular mowers advertise features that don’t match this, and you don’t want to spend an extra few hundred dollars on advanced features that won’t deliver a noticeable difference in your yard.

Instead, look for: Only as much as you need

Do you have a mostly flat lawn with no fences and need a robot that can navigate to several sections separated by paths? Then you can skip AWD models and commit to superior mapping and navigation features, like multi-zone intelligence.

Also: I let a modular yard care robot mow my lawn – here’s my verdict after a month

Similarly, if you have a yard with dense trees covering most of it, it’s safe to skip the RTK models and go for LiDAR or boundary wire options instead. 

3. Don’t focus on: Flashy app features

Mammotion Luba 2 robot mower path

The path lines created by the Mammotion Luba 2, as captured by our Bink Outdoor camera, is one flashy app feature I can’t quit.

Maria Diaz/ZDNET

Any dependable robot lawn mower requires an equally reliable mobile app to let you use it effectively. However, manufacturers market many flashy app features that end up being unnecessary for many users. 

Don’t make app features the deciding factor unless it’s something you genuinely care about. Many users don’t rely on voice control to run their mowers and don’t mind using a separate app for their robot rather than integrating it into an existing home automation system.

Also: I let a smart planter maintain itself for 2 months – here’s the result

A robot lawn mower with mediocre navigation and cutting performance can still have a flashy app — all while leaving behind missed patches or taking longer to finish mowing.

Instead, look for: The features you’ll actually use

Most robot mower users keep them running on a schedule to get the lawn-cutting chore off their minds. The majority of the most popular models offer basic features beyond scheduling, such as remote start and stop, basic mapping, automatic rain delay, and theft protection. 

It’s easy to find robot lawn mowers with these features, but if you’re looking for anything beyond that, just be sure that the feature is worth it, especially if you’re paying extra for that model.

Also: I’ve tested robot mowers for years – here’s my expert advice for every yard type

An example of a flashy app feature that is completely unnecessary, but I love having? The Mammotion’s pattern cutting. I can select the cutting pattern I want on the Mammotion app, whether I want lines or checkered, but I can also have the robot cut in custom patterns, like letters and numbers. I don’t care for mowed letters in my yard, but I like that it always has that freshly mowed checkered patterned with no effort from me. 

4. Don’t focus on: Cutting system extras

Segway Navimow X3 Series robot mower

Maria Diaz/ZDNET

The cutting width and system specs are important, as they can determine whether a robot can cover a given area in a day. However, most robot mowers use similar multiple-blade mulching systems. 

Unlike traditional lawn mowers with large blades for aggressive cutting in a single pass, robot mowers typically feature a set of small blades that constantly spin. Because of this, robot mowers trim smaller amounts of grass with each pass than a traditional mower, but they also cut more frequently and leave behind smaller grass clippings that decompose naturally.

Also: I powered my 3,000-sq-ft home with an EcoFlow battery in a blackout – here’s how it kept my AC on

Because the robot mowers have a smaller, compounding cutting system, the real-world differences between the cutting systems from one brand to another are often smaller than you’d expect. Other issues, like poor navigation, will be glaringly obvious before small differences in blade design.

Instead, look for: Cutting width and yard size

The average US yard would benefit more from navigation quality, consistency, and connectivity than blade design. Instead, you should focus on matching the mower to your yard size.

The robot’s capacity is measured in how many acres it can cover in a day. Among other features, this is calculated based on your robot’s battery size and cutting width. Essentially, most users want a robot that can mow an entire yard in a day, so you can set it and forget it and always come home to a mowed yard. You get this by getting the appropriate robot for your yard size.





Source link

Hackers accessed BWH Hotels reservation system for months

Critical fortinet vulnerabilities fixed in FortiSandbox and FortiAuthenticator

Instructure settles with hackers following massive student data theft

Copyright © 2024 All Rights Reserved.