Windows Secure Boot Update Before Expiry

Windows Secure Boot certificates are reaching their End of Life starting June 2026.
If you have not updated your UEFI CA certificates, your PC's boot-level security is about to expire.

This repository provides a simple guide and a ready-to-use .reg file to manually trigger the update — no advanced IT skills required.

---

🔴 Deadlines

Phase	Date	What Expires
Initial	June 2026	Microsoft Corporation KEK CA 2011 & UEFI CA 2011
Final enforcement	October 2026	Windows Production PCA 2011 (bootloader signing cert)

📖 Official Microsoft source: Act now: Secure Boot certificates expire in June 2026

---

✅ Step 1 — Check If You Are Already Updated

Open PowerShell as Administrator and run:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

• True = You are already updated. Nothing more to do! ✅
• False = Continue to Step 2 below.

---

🛠️ Step 2 — Apply the Update (Two Options)

Option A — Use the .reg File (Easiest)

1. Download Boot-Certificate-Available-Updates.reg from this repository
2. Double-click the file
3. Click Yes when prompted by Windows
4. Continue to Step 3

Option B — PowerShell Command (Manual)

Open PowerShell as Administrator and run:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

---

▶️ Step 3 — Activate the Update

Open PowerShell as Administrator and run:

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

---

🔁 Step 4 — Restart Windows Twice

This is the most important step. You must restart your PC two times for the update to fully apply.

---

✅ Step 5 — Verify the Update

After restarting twice, open PowerShell as Administrator and run the check again:

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

• True = Successfully updated! ✅
• False = Repeat from Step 2 or check Microsoft's official guidance.

---

📝 Note on Registry Key Names

Microsoft's official documentation references this value as MicrosoftUpdateManagedOptIn in enterprise scenarios.
The key used here, AvailableUpdates, applies the same registry path and hex value (0x5944) and produces the same result for home and manual update scenarios.

---

📁 Files in This Repository

File	Description
Boot-Certificate-Available-Updates.reg	Ready-to-use registry file to trigger the Secure Boot certificate update
Windows-Secure-Boot-is-EXPIRING-Do-This-Before-June-2026.txt	Plain-text guide with all steps

---

🔗 References

• Microsoft Tech Community — Act now: Secure Boot certificates expire in June 2026
• Microsoft Support — Registry key updates for Secure Boot