# Windows Secure Boot certificates begin expiring in June 2026 **URL:** \ **Category:** Framework Laptop 13\ **Tags:** windows, bios, intel-12th\ **Created:** [February 17, 2026, 2:35pm UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703 "2026-02-17T14:35:31Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![Paul\_Tetu](https://avatars.discourse-cdn.com/v4/letter/p/c6cbf5/32.png) [@Paul\_Tetu](https://community.frame.work/u/Paul_Tetu)\ **Post date:** [February 17, 2026, 2:35pm UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703/1 "2026-02-17T14:35:32Z")
This is general to all Framework computers, but I had to choose a category. 🤷‍♂️ Microsoft has announced that its Secure Boot certificates will begin expiring a few months from now ([Microsoft Secure Boot certificates begin expiring in June 2026](https://support.microsoft.com/en-us/topic/when-secure-boot-certificates-expire-on-windows-devices-c83b6afd-a2b6-43c6-938e-57046c80c1c2)). My Framework 13 has one of the expiring certificates and M$ indicates that some devices will be updated by OEM manufacturers, possibly via firmware. ([More info from Ars Technica here](https://arstechnica.com/gadgets/2026/02/microsoft-sounds-the-alarm-about-secure-boot-certificates-expiring-later-this-year/)) Does anyone know whether our machines will need special attention from Framework or if a regular Windows update will resolve this? There’s still plenty of time, I just like to know what to expect. Thanks! ---
**Author:** ![GhostLegion](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/ghostlegion/32/3356_2.png) [@GhostLegion](https://community.frame.work/u/GhostLegion)\ **Post date:** [February 17, 2026, 3:07pm UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703/2 "2026-02-17T15:07:32Z")
I’m uncertain if BIOS updates will be rolled out via Windows Update. Traditionally the updates are made available via knowledge base or on the forum as an .exe to run/install. ---
**Author:** ![Paul\_Tetu](https://avatars.discourse-cdn.com/v4/letter/p/c6cbf5/32.png) [@Paul\_Tetu](https://community.frame.work/u/Paul_Tetu)\ **Post date:** [February 17, 2026, 3:24pm UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703/3 "2026-02-17T15:24:15Z")
Thanks, I appreciate the input. I agree, if it has to be a BIOS update, I’d expect it to come from Framework. If it doesn’t require a firmware update, I guess it could be through the regular Windows update channels. I’m hoping that Framework will make an announcement soon about how this will happen. ---
**Author:** ![DHowett](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/dhowett/32/1990_2.png) [@DHowett](https://community.frame.work/u/DHowett)\ **Post date:** [February 17, 2026, 3:47pm UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703/4 "2026-02-17T15:47:36Z")
Two things! 1. Most Framework programs have already received firmware updates to add the new UEFI CA 2023 KEK certificate. You can search the firmware release notes for “UEFI CA 2023” or equivalent. Note that many of their recent products came out after this transition, and their use of the newer CA cert may not be reflected in their firmware update release notes. 2. It is not likely to actually matter: [mjg59 | Secure boot certificate rollover is real but probably won't hurt you](https://mjg59.dreamwidth.org/72892.html) ---
**Author:** ![Paul\_Tetu](https://avatars.discourse-cdn.com/v4/letter/p/c6cbf5/32.png) [@Paul\_Tetu](https://community.frame.work/u/Paul_Tetu)\ **Post date:** [February 17, 2026, 4:05pm UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703/5 "2026-02-17T16:05:21Z")
Fantastic! I updated BIOS once last year and didn’t realize there was another release on Oct 31 that “Added Framework’s dbx key and updated the default CA of Windows Secure Boot”. Sounds like the solution I was looking for. Thanks! Edit: I ran the BIOS update, it went fine, and I confirmed that it the new certificate is installed. Thanks for all the quick responses! ---
**Author:** ![Kyle\_Farnung](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/kyle_farnung/32/17460_2.png) [@Kyle\_Farnung](https://community.frame.work/u/Kyle_Farnung)\ **Post date:** [April 8, 2026, 3:16am UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703/6 "2026-04-08T03:16:43Z")
It looks like my Framework 13 AMD 7040 hasn’t gotten the KEK certificate update yet. Is this update planned? EDIT: It looks like 3.16 included the updated certificates, but they weren’t showing up in Windows. For anyone else who has this issue the solution appears to be the **suspend Bitlocker (or ensure you have the recovery key)** and then reset the secure boot settings to factory default in the BIOS. Now it looks like my certificates are fully up-to-date. ---
**Author:** ![Walter\_I\_Wittel\_Jr](https://avatars.discourse-cdn.com/v4/letter/w/9de053/32.png) [@Walter\_I\_Wittel\_Jr](https://community.frame.work/u/Walter_I_Wittel_Jr)\ **Post date:** [April 27, 2026, 10:31pm UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703/7 "2026-04-27T22:31:57Z")
> [@Kyle\_Farnung](#): > > EDIT: It looks like 3.16 included the updated certificates, but they weren’t showing up in Windows. For anyone else who has this issue the solution appears to be the **suspend Bitlocker (or ensure you have the recovery key)** and then reset the secure boot settings to factory default in the BIOS. Now it looks like my certificates are fully up-to-date. Thanks for your hint. For 12th Gen i7-1260P with BIOS 03.19, latest Win11 25H2, the certificates were fine, but I was getting a yellow triangle warning badge on Windows Security / Device Security. I made sure I had my recovery key, Suspended protection in the BitLocker control panel, rebooted-\>F2, reset secure boot in BIOS as you suggested, and rebooted. I got a strange “Wizard Initialization has Failed” dialog when checking the control panel to verify BitLocker was re-enabled (it was). Note the BitLocker recovery key had not changed and the Device Security warning was still on. A second reboot cleared the warning when opening the BitLocker page and in Device Security. For anyone searching for the text of the Device security warning: "Secure Boot is on, but your device does not support the automated Secure Boot certificate update due to hardware or firmware limitations. Contact your device manufacturer for assistance. " ---
**Author:** ![Brett\_Holland](https://avatars.discourse-cdn.com/v4/letter/b/bbe5ce/32.png) [@Brett\_Holland](https://community.frame.work/u/Brett_Holland)\ **Post date:** [May 18, 2026, 2:20pm UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703/8 "2026-05-18T14:20:46Z")
Any guess if resetting Secure Boot for the 11th gen will also work? Currently, the status in Windows 11 for my 11th gen is “Secure Boot is on, but your device is using an older boot trust configuration that should be updated. There is not yet enough data to classify your device for automatic update.” My laptop is running the latest 3.24 firmware. ---
**Author:** ![DHowett](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/dhowett/32/1990_2.png) [@DHowett](https://community.frame.work/u/DHowett)\ **Post date:** [May 19, 2026, 1:16am UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703/9 "2026-05-19T01:16:20Z")
> [@Brett\_Holland](#): > > Any guess if resetting Secure Boot for the 11th gen will also work? I believe it will, and unless you have a custom Secure Boot configuration it is safe to try. ---
**Author:** ![Hugh\_McKay](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/hugh_mckay/32/15949_2.png) [@Hugh\_McKay](https://community.frame.work/u/Hugh_McKay)\ **Post date:** [May 19, 2026, 10:32pm UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703/10 "2026-05-19T22:32:27Z")
There is a video explaining the expiry of these certificates and what to do for both Windows and Linux. [![](https://us1.discourse-cdn.com/flex001/uploads/framework3/original/3X/e/f/efba74d94bc0f465b516de94dc9acba20cbd0163.jpeg "Secure Boot Certificate Expiry (Windows & Linux)") ](https://www.youtube.com/watch?v=_AwzaZmRNsI) ---
**Author:** ![Daniel\_Schaefer](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/daniel_schaefer/32/10314_2.png) [@Daniel\_Schaefer](https://community.frame.work/u/Daniel_Schaefer)\ **Post date:** [May 20, 2026, 8:30am UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703/11 "2026-05-20T08:30:00Z")
I have also addressed this question here > > > \## Device Information > > \### System Model or SKU > > \- \[x\] Framework Laptop 16 (AMD R…yzen™ 7040 Series) > > > \### BIOS VERSION > > > SMBIOSBIOSVersion > 04.03 > > > The following are for Laptop 16 only. > GPU: Nvidia 5070 > Cards: three USB Type C, two USB type A, 3.5mm audio > > > \### Standalone Operation (Laptop Only) > Are you running your mainboard as a standalone device. Is standalone mode enabled in the BIOS? > No > > \## Describe the bug > Framework Laptop 16 7040 BIOS series firmware version 4.03 is using expiring certificates from 2011 and need to be updated to the 2023 certificates per \[KB5062710\](https://support.microsoft.com/en-us/topic/windows-secure-boot-certificate-expiration-and-ca-updates-7ff40d33-95dc-4c3c-8725-a9b95457578e#ID0EDF) > > > \## Steps To Reproduce > Steps to reproduce the behavior: > 1. Go to UEFI Settings > 2. Open Administer Secure boot > 3. Open the KEK Options > 4. See the cert as shown below > \`\`\` > 01. \[PKCS7\] Microsoft Corporation KEK CA 2011 > KEK Signature List: > Owner\_GUID: 77FA9ABD-0359-4D32-BD60-28F4E 78F 784B > \`\`\` > > \## Expected behavior > The key I'm expcting to see is: > \[Microsoft Corporation KEK 2K CA 2023 > SHA-1 cert hash: 459AB6FB5E284D272D5E3E6ABC8ED663829D632B. > SignatureOwner GUID: {77fa9abd-0359-4d32-bd60-28f4e78f784b}.\](https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-secure-boot-key-creation-and-management-guidance?view=windows-11#14-signature-databases-db-and-dbx) > > \## Screenshots > > !\[Image\](https://github.com/user-attachments/assets/52c6ee65-0982-4b7c-be5f-83d9ca24b06e) > > \Image > > \## Operating System (please complete the following information): > - OS/Distribution: Windows 11 > - Version: 25H2 > > \## Additional context > N/A ---
**Author:** ![Brett\_Holland](https://avatars.discourse-cdn.com/v4/letter/b/bbe5ce/32.png) [@Brett\_Holland](https://community.frame.work/u/Brett_Holland)\ **Post date:** [May 27, 2026, 12:29am UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703/12 "2026-05-27T00:29:23Z")
Unfortunately, it did not work. Under Security → Secure Boot, I enabled the option to reset Secure Boot. My 11th gen rebooted, Windows complained about a driver incompatibility and forced a restart, after which Windows booted fine. I rebooted again from the login screen, then logged in and checked Device Security. The Secure Boot message had not changed. ---
**Author:** ![DannyT](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/dannyt/32/2856_2.png) [@DannyT](https://community.frame.work/u/DannyT)\ **Post date:** [May 28, 2026, 12:36am UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703/13 "2026-05-28T00:36:47Z")
The message still appears for me on my 11th gen intel 13"… but when I check KEK and db they both show the proper 2023 one instead of 2011 (and both are listed in the bios). The windows secure boot message doesn’t check if your computer has the proper one, it only checks if your make/model is capable of automatically updating the kek, which the older frameworks cannot… so basically you might be stuck with the message pop up… but it is still secure and will continue to update all security patches as long as you have the 2023 one… well until probably 2030 or whenever the newer one expires. ---
**Author:** ![Carl\_Samans](https://avatars.discourse-cdn.com/v4/letter/c/e9c0ed/32.png) [@Carl\_Samans](https://community.frame.work/u/Carl_Samans)\ **Post date:** [June 19, 2026, 3:01pm UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703/14 "2026-06-19T15:01:18Z")
Thanks, after reset, too a few minutes for Windows to clear the error. ---
**Author:** ![Kyle\_Farnung](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/kyle_farnung/32/17460_2.png) [@Kyle\_Farnung](https://community.frame.work/u/Kyle_Farnung)\ **Post date:** [June 19, 2026, 4:01pm UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703/15 "2026-06-19T16:01:16Z")
On my 11th gen the fix was a lot more complicated: [Framework Laptop 13 - 11th Gen Intel Core BIOS 3.24 Release STABLE - #31 by Kyle\_Farnung](https://community.frame.work/t/framework-laptop-13-11th-gen-intel-core-bios-3-24-release-stable/75534/31) ---
**Author:** ![DannyT](https://sea1.discourse-cdn.com/flex001/user_avatar/community.frame.work/dannyt/32/2856_2.png) [@DannyT](https://community.frame.work/u/DannyT)\ **Post date:** [June 19, 2026, 8:32pm UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703/16 "2026-06-19T20:32:02Z")
LOL, actually… my steps were fairly similar to yours (had to rebuild the boot partition etc), I was just too exhausted to type that all on a forum. Even after all that I still have the warning message in windows security, but have confirmed several times that it’s using the new cert! ---
**Author:** ![Omair](https://avatars.discourse-cdn.com/v4/letter/o/898d66/32.png) [@Omair](https://community.frame.work/u/Omair)\ **Post date:** [August 2, 2026, 2:43pm UTC](https://community.frame.work/t/windows-secure-boot-certificates-begin-expiring-in-june-2026/80703/17 "2026-08-02T14:43:05Z")
hi FW 13 with 7840U, yellow triangle on the SEcure boot in W11. running 3.20 and the latest drivers from FW ( and updated smae from AMD’s website today)