I’d bet you’ve spent exactly zero minutes thinking about Secure Boot, unless you’ve wanted to replace Windows with another operating system and had to disable it for that to happen.
Secure Boot is a feature of UEFI, and it’s a requirement for any computer that wants to run a modern version of Windows. It exists to protect us against malware that infects your computer’s bootloader. There’s a security certificate stored in the UEFI which your computer uses to check the Windows bootloader, to ensure it’s legitimately signed by Microsoft, and not an imposter.
So far, so good, but what happens when the certificate in your UEFI expires? Well, we’re all about to find out.
Expiration doesn’t break your PC—but it does weaken it
The tech debt is real
First, this is all happening by design. The expiration of cryptographic certificates is a feature, not a bug. It happens with all sorts of devices and apps without you ever being the wiser. All that has to happen is a rollover to new certificates. However, in many cases it’s not going to be possible to do this for Secure Boot.
The good news is that this isn’t going to make your PC fail overnight. It just means that if you try to boot using a bootloader with a newer certificate than the one in your UEFI, it’s going to work, but your overall security level will be degraded. It can’t install new boot-level security updates like revocation lists or Windows Boot Manager fixes, leaving it exposed to emerging bootkit threats. Of course, you can simply turn off Secure Boot in your UEFI settings. Then your computer will boot any operating system, but that’s even less secure.
Without a new certificate, your computer becomes vulnerable to the exact threats Secure Boot was designed to prevent.
Microsoft’s fix is a full secure boot certificate rollover
We’re used to turning if off and on again
To prevent that scenario, Microsoft is rolling out an entirely new Secure Boot trust chain based on updated certificates issued in recent years.
On supported systems, much of this happens behind the scenes. Windows Update delivers the necessary changes, while OEM firmware updates ensure the system’s UEFI environment can accept and use the new certificates.
But, what if you don’t have a supported system?
Windows 11 systems will transition, Windows 10 mostly won’t
Win 10 users are being left even further behind
Windows 10 reached end-of-life in October 2025. That means no more updates, no maintenance, and no guarantee that you’ll get to participate in the certificate rollover.
There are a few exceptions. Systems enrolled in Microsoft’s Extended Security Updates (ESU) program may receive limited support for this transition, but that’s a paid, temporary solution aimed mostly at businesses.
New Windows 11 PCs already have the certificates, and it’s reasonable to assume that if someone’s hardware supported Windows 11, they’d have upgraded by now. If a given UEFI version doesn’t support Windows 11, then the OEM might not have much of an incentive to send firmware updates either. After all, they consider those motherboards end-of-life too.
This creates a long-term security divide you can’t easily fix
In some cases your hands are tied
Lucas Gouveia / Corbin Davenport / How-To Geek
Updating Secure Boot isn’t just a Windows-level change. It depends on firmware updates from your PC’s manufacturer, compatibility with newer certificate chains, and careful coordination between multiple components.
Unless your computer is getting it all, then you don’t have a fully working Secure Boot solution. The longer these older machines fall behind, the more likely that newer malware will easily get through any verification, partly due to a lack of new security features.
How much of an issue is this really?
We need to move on, one way or another
Look, the truth is that if your Windows 10 computer can be updated to Windows 11, you should go ahead and do it. If you can make a relatively minor hardware upgrade to qualify for Windows 11 support, consider making that investment as long as it’s not too expensive.
Failing this, consider switching to an operating system other than Windows. Remember that both your operating system and UEFI need to be updated for Secure Boot to work. So if your UEFI does get an update, but Windows 10 doesn’t, that doesn’t help.
Many distros of Linux support secure boot, and aren’t leaving old hardware behind. Zorin OS, for example, supports Secure Boot and it also happens to be a distro designed specifically to look and feel like Windows. So as long as you don’t need to use software that has no way to run under Linux, you might not even notice your OS has changed.
It’s a good idea to check your motherboard’s support page to see if a firmware update for Secure Boot is available or on the way, but the firmware side of this equation, unlike your operating system, is something you simply don’t have control over.
Stephan is the sports journalist for the Maple Grove Report.
