Microsoft's 2011 Secure Boot certificates expire June 24 — unpatched systems lose protection against future UEFI bootkits
Three Microsoft Secure Boot certificates — the 2011-dated signatures underpinning UEFI chain-of-trust — expire June 24, a rotation forced by LogoFail, the 2023 image-parsing vulnerability that let attackers bypass Secure Boot on nearly every Windows and Linux device. Most Windows machines pick up the 2023 replacement certificates through regular monthly patches; Linux users need updated UEFI shims from their distribution — and systems that miss the cutoff retain normal boot function but lose protection against new firmware-level attacks, including UEFI bootkits like BlackLotus.
Source: wired.com ↗
Machines that fail to update the Secure Boot-related keys will continue to function, but they will no longer be protected against new UEFI threats.
Why this matters
- → Unpatched systems lose Secure Boot protection against firmware-level malware.
- → UEFI bootkits survive OS reinstalls and antimalware detection.
- → LogoFail vulnerability made key rotation mandatory industry-wide.