{
  "$type": "site.standard.document",
  "bskyPostRef": {
    "cid": "bafyreih4btn4ly32vfckb3axftarz7bmlegl475amouuvcukirpcolqnbu",
    "uri": "at://did:plc:xj2drxwuk2r3tfelpnw2uqog/app.bsky.feed.post/3mpllhip3dyo2"
  },
  "coverImage": {
    "$type": "blob",
    "ref": {
      "$link": "bafkreic4bhpsfcqlp6g435es6lg5snye3usfklyjwdqp23afsmydfz373m"
    },
    "mimeType": "image/webp",
    "size": 72120
  },
  "path": "/article/3180433/your-windows-pc-is-at-risk-if-youre-missing-these-security-certificates.html",
  "publishedAt": "2026-07-01T13:00:00.000Z",
  "site": "https://www.pcworld.com",
  "tags": [
    "Security Software and Services, Windows",
    "expiring Secure Boot certificates",
    "guide from Windows Latest",
    "install an app",
    "HWiNFO",
    "enter the UEFI/BIOS at boot",
    "Compromised browser extensions",
    "The vendors who manufactured your hardware do"
  ],
  "textContent": "You’ve probably seen countless warnings lately about Windows and expiring Secure Boot certificates. Why? Some PCs haven’t gotten the updates yet—and won’t unless you take action.\n\nThat’s the first problem. The second? Even if you do prep your machine appropriately, you may not get the new certificates immediately.\n\nHere’s what you should know, how to stay safe online until your PC gets the necessary updates… and how to tell if your PC will even get this upgrade.\n\n## What is Secure Boot?\n\nAt startup, your PC loads the necessary code to start Windows. In the old days, this boot sequence was not protected, and hackers used that freedom to create sneaky malware that could modify Windows and also evade antivirus software detection.\n\nMicrosoft implemented Secure Boot to block such attacks. Think of it as similar to being at a checkpoint where an agent looks at your ID, sees if it matches the information in their database, and only lets you through if you’re a match on that approval list. On your PC, Secure Boot’s security certificates are that “database.” To run at boot, the “ID” (digital signature) of drivers, software, etc. **must** have a match within the certificate’s stored info.\n\nSome PCs still use older Secure Boot certificates issued in 2011. Three of the four expired during the last full week of June 2026. The final one expires in October 2026. For full protection, your computer should be using newer Secure Boot certificates, issued in 2023.\n\n## How to tell if you have expired Secure Boot certificates\n\nA Secure Boot certificate warning in the Windows Security app.\n\nASUS\n\nYou can still run a PC without up-to-date Secure Boot certificates, so don’t assume that if your PC still boots, it’s all set.\n\nHowever, many PCs did automatic upgrades to the 2023 Secure Boot certificates. If yours hasn’t, Windows should notify you of the issue—check for a blue shield icon in your Taskbar’s system tray, with either a yellow or red mark on it.\n\nDon’t see any such warning? Double-check by opening the Windows Security app, choose _Device Security_ , and look at the icon next to the words _Secure Boot_. A green checkmark means you’re good to go. A yellow or red warning indicator means you must take action.\n\n## 3 things to do if you have expired Secure Boot certificates\n\nIf you see a yellow or red warning about Secure Boot, you need to check your PC to see if it is able to receive those auto-updates. Microsoft is expanding its rollout of automatic certificate updates, but it can’t push those newer certs if your firmware is out of date.\n\nOnce you’ve settled that question, you also need to take a couple of precautions as you wait for the updated Secure Boot certifications.\n\n### 1 – Update your PC’s UEFI/BIOS to the latest version\n\nThe UEFI for an Asus motherboard.\n\nIan Paul / Foundry\n\nUEFI is software that handles a PC’s startup process. It’s the successor to BIOS, which was an older, simpler type of software that did the same job. (The term BIOS has been around long enough that people still use it, even when referring to UEFI.) If this firmware on your motherboard isn’t up-to-date enough, Microsoft can’t automatically update your Secure Boot certificates.\n\nSo if you’re seeing a yellow or red warning about Secure Boot, make sure your UEFI/BIOS version is as current as possible.\n\n#### You bought a PC from Dell, Lenovo, HP, etc:\n\nFind the support page for your PC model. You can often use automatic diagnostic tools that analyze your system and report back on what your PC’s UEFI/BIOS is, as well as help you update to the most recent version.\n\nIf you’re having problems understanding the support pages or finding the right info, you can instead use this guide from Windows Latest. It explains where to find Secure Boot update information for each major vendor.\n\nLenovo\n\n#### Your PC is built from scratch (DIY)\n\nThis scenario applies to a computer you built—or someone built for you (including some boutique PC vendors).\n\n  1. Determine your current UEFI/BIOS version. Within Windows, you can install an app called HWiNFO that will reveal that detail. Otherwise, just restart your system and enter the UEFI/BIOS at boot. Usually the version info is at the top or the side of the screen.\n\n\n  2. Next—head to your motherboard manufacturer’s support page. Ensure you have the page that matches your specific mobo version (e.g., REV 1.0 vs REV 2.0), not just model number.\n\n\n  3. Compare your UEFI/BIOS version against the list of UEFI/BIOS revisions. Check the release notes for any that mention Secure Boot certificate updates. Don’t see any mentions? Just update to the latest version.\n\n\n  4. Update your BIOS. For these manual DIY UEFI/BIOS updates, you usually have to do these the old-school way: Download the update files, put them on a flash drive, then boot into your UEFI/BIOS to install the updates.\n\n\n\n**Note** : If your UEFI/BIOS version is pretty old, I recommend updating your UEFI/BIOS in several jumps. Going in one shot—applying the latest update to a very old version—can sometimes cause issues. Update more gradually by identifying major UEFI/BIOS releases (as marked in the release notes), then working your way through those to the most recent version.\n\nThis is the German-language version of HWiNFO, but the layout is the same in English.\n\nPC-Welt\n\n#### Your PC is semi-DIY\n\nSome PCs live somewhere between prebuilt and DIY. One example—Intel NUC PCs, which were designed more for business customers and weirdo enthusiasts (hello).\n\nFor these kinds of systems, you may be able to download a vendor-provided tool that reports on the PC’s status, including the exact model number and the UEFI/BIOS version. (Such a tool does exist for Intel NUCs.) Looking up the support page and any relevant UEFI/BIOS updates is much easier as a result.\n\nThe UEFI/BIOS update may also have self-executing versions you can run from within Windows. It reduces the amount of time needed to perform the UEFI/BIOS update—no need to load up a flash drive, reboot into the UEFI/BIOS, and manually upgrade. This is not a guarantee your PC will also have such an option, but it’s more likely.\n\nIntel made a manual UEFI update for an older NUC PC surprisingly pleasant.\n\nIntel\n\n### 2 – Exercise more caution when online\n\nHaving out-of-date Secure Boot certificates isn’t an immediate, red-alert danger for your PC. But over time (and possibly not much time, given how fast AI enables vulnerability discoveries and malware development), your PC will become more vulnerable to attack.\n\nSo while you’re in limbo, watch sites you visit, what browser extensions you install, and what software you download. Malicious sites can deposit malware on your system without you knowing. Compromised browser extensions can also end up putting malware on your PC. And downloading pirated apps can again have malware embedded in them.\n\n### 3 – Keep your antivirus software updated\n\nAlaina Yee / Foundry\n\nGenerally, antivirus software run within Windows has a harder time spotting bootkits and other malware lurking within your startup process. So you can’t rely on security software to remove an existing infection.\n\nBut staying on top of antivirus software updates can still be helpful for avoiding bootkits _before_ they get installed. If your app knows what to look for, it can block you from accidentally installing such nasty code on your PC.\n\nSo give yourself better odds with up-to-date virus definitions.\n\n## What if my PC can’t get Secure Boot certificate updates?\n\nUnfortunately, Microsoft doesn’t decide if your PC will get updated Secure Boot certificates. The vendors who manufactured your hardware do. They must issue firmware that will support the new certs. If they don’t, you’re out of luck.\n\nHow will you know? For prebuilt PCs and laptops from makers like Dell, Lenovo, HP, etc, their Secure Boot update guides may outline the policy. For computer components, their support pages may outline that info. If you can’t find this information, try support forums for further info.\n\nPragmatically speaking, if your PC’s manufacturer no longer supports your computer, you’re likely facing a forced hardware upgrade. You could look at switching to Linux, but many distros rely on the same certificates as Windows.\n\nWhat about continuing to use your PC without updated Secure Boot certificates? I don’t recommend doing it for too long. Online threats continue to increase, and at faster and faster speed. Don’t save some cash to ultimately pay with your time, should someone compromise your PC.",
  "title": "Your Windows PC is at risk if you’re missing these security certificates"
}