Secure Boot Certificates Are About to Expire — Here's What Windows and Linux Users Need to Know

A Security Deadline No One Should Ignore

A significant cybersecurity deadline is quietly approaching, and millions of Windows and Linux users may not even know it exists. Starting June 24, three Microsoft-signed cryptographic certificates that serve as the backbone of Secure Boot will reach their expiration date. These certificates play a fundamental role in verifying the authenticity of every piece of firmware and software that loads when a computer boots up.

Secure Boot was built on the principle of a trusted chain — a verification process that checks digital signatures on all firmware during startup to confirm it comes from a legitimate, manufacturer-approved source. If any link in that chain is unrecognized or tampered with, Secure Boot halts the boot process entirely. Without updated certificates, that protection quietly disappears.

What Is Secure Boot and Why Does It Matter?

To understand the stakes of this deadline, it helps to understand what Secure Boot is actually guarding against. The technology was developed by Microsoft in collaboration with hardware manufacturers as a direct response to one of the most insidious categories of malware ever devised — UEFI bootkits.

The UEFI, or Unified Extensible Firmware Interface, is the modern successor to the traditional BIOS. It initiates the very first steps of the boot sequence before the operating system even loads. Bootkits exploit this early-access window by embedding malicious code directly into the firmware, allowing them to operate invisibly beneath the OS layer.

This makes UEFI bootkits extraordinarily dangerous. They can steal credentials, open backdoors, deploy secondary malware onto the operating system, and — perhaps most alarmingly — survive a complete OS reinstallation. Even a full wipe of the hard drive and fresh OS install won't remove a bootkit that has embedded itself in the firmware.

A Brief History of Bootkit Threats

Early Origins

The story of bootkits stretches back further than most people realize. The earliest examples appeared in the 1980s, targeting Apple II computers during startup. These primitive pieces of malware spread through floppy disks that were disguised as pirated games.

The Windows Era and Proof-of-Concept Attacks

By the early 2000s, security researchers working in offensive research had begun demonstrating Windows-targeted bootkits as proof-of-concept tools. One of the earliest notable examples, BootRoot, was showcased at the Black Hat security conference in 2005. It infected the Network Driver Interface, disrupting communications between network protocol drivers. In the years that followed, additional PoC bootkits emerged — including Vbootkit, the Stoned Bootkit, and Mebroot — each pushing the boundaries of what firmware-level malware could accomplish.

Targeting UEFI Directly

By 2012, attackers had shifted their focus toward more modern firmware targets. One bootkit compromised Mac OS X systems through the EFI firmware layer, while another took aim at Windows 8 machines via the UEFI. Around 2013, a researcher demonstrated an advanced UEFI-targeting bootkit for Windows known as Dreamboat, signaling that this attack surface was becoming increasingly exploited.

Real-World UEFI Attacks Emerge

The transition from theoretical threat to confirmed real-world attack came in 2018 with the discovery of LoJax — widely recognized as the first known UEFI bootkit deployed in live attacks. LoJax was a weaponized version of LoJack, legitimate anti-theft software. It was engineered by Fancy Bear, also known as APT 28 or Sednit, a hacking group with ties to the Kremlin. The malware was delivered remotely and used specialized tools to read and overwrite sections of UEFI flash memory.

Two years later, in 2020, researchers at Kaspersky uncovered a second real-world UEFI threat they named MosaicRegressor. Each time an infected machine restarted, the compromised UEFI checked for a specific malicious file in the Windows startup folder and reinstalled it if absent. How the UEFI itself was initially infected remains unknown. Since then, additional UEFI bootkits tracked under names such as ESpecter, FinSpy, and MoonBounce have been documented by the security community.

The LogoFail Vulnerability Changed Everything

In 2023, researchers uncovered a sweeping vulnerability known as LogoFail, which affected UEFI implementations across virtually every Windows and Linux system globally. The flaw resided in image-parsing code responsible for displaying hardware manufacturer logos during startup. Attackers could exploit this bug to bypass Secure Boot entirely and inject malicious firmware — effectively neutralizing the protection the system was designed to provide.

This discovery forced Microsoft's hand. The three existing Secure Boot cryptographic certificates, originally issued in 2011, are now being retired and replaced with updated certificates dated 2023. The transition is currently underway for Windows 10 and Windows 11 devices. Linux distributions are simultaneously updating their "shims" — lightweight, first-stage UEFI bootloaders that function as trusted bridges between Secure Boot keys and the full Linux bootloader.

What Happens If You Don't Update?

Machines that fail to receive the new certificates before the deadline will continue to operate normally in most respects — but their Secure Boot protection will no longer guard against new UEFI-based threats. It's worth noting that these systems were already exposed to LogoFail-related attacks. The certificate refresh is specifically designed to close that gap and provide resilience against future UEFI vulnerabilities that have yet to be discovered.

In short, an unpatched system is a system flying without a safety net.

How to Check and Update Your System

For Windows Users

Verifying your Secure Boot certificate status on Windows is straightforward. Navigate to Windows Security Settings → Device Security → Secure Boot. A green checkmark confirms the update has been applied successfully. The majority of Windows machines receive certificate updates automatically through Microsoft's standard monthly patch cycle. However, older devices may require manual intervention to complete the process.

Microsoft also strongly advises users to keep all firmware up to date, as firmware updates are sometimes a prerequisite for Secure Boot certificate changes to apply correctly.

For Linux Users

Linux users should monitor their respective distribution channels for the release of updated shims. Staying current with system and firmware updates is the most reliable way to ensure continued Secure Boot protection.

The Bottom Line

This isn't a theoretical risk or a distant concern — the deadline is here. As UEFI bootkits grow more sophisticated and widespread, the integrity of the Secure Boot certificate chain is one of the most important lines of defense available to everyday users and enterprise environments alike. Taking a few minutes to verify and update your system now could prevent a deeply embedded, nearly invisible compromise later.