Article ID Code:GK-CPI-05
According to an official announcement from Microsoft, the legacy certificate used for Microsoft Secure Boot, which has been in place since 2011, will expire between June and October 2026. The expiration of this certificate may have certain implications for personal devices.
Situation | Impact Level | Description |
| Can the computer still boot normally? | Almost no impact | The computer can still start up, run programs, and access the internet normally after expiration |
| Daily use (office work, gaming, watching videos) | Basically no impact | Does not affect the browser, software, or files |
| Normal Windows updates | Most are possible | Regular security updates and feature updates can still be installed |
| Security protection during startup | Gradually decreases | Unable to receive new Boot Manager, Secure Boot database, or revocation list updates |
| Newly discovered bootkit/startup-level vulnerability fixes | Cannot be obtained | Security decreases over the long term (like an house's lock not being replaced, but the door can still be used) |
| BitLocker encrypted drives | May be affected | Some enhanced functions or new mitigation measures cannot be applied |
| Very rare special cases | Third-party startup items may fail | Such as certain older graphics card VBIOS, special dual-boot bootloaders |
In the short term, there will be virtually no noticeable impact, but long-term security will be compromised—especially when new vulnerabilities emerge after the second half of 2026.
As shown in the figure, the method to enable the Secure Boot option in BIOS. On most devices, it is enabled by default and requires no manual configuration.
What Do You Need to Do as a Personal User?
Keep Windows Update enabled and install updates promptly
Settings → Windows Update → Advanced Options → Receive updates for other Microsoft products (turn on)
For most computers manufactured after 2020, the new 2023 certificate will be automatically pushed via regular cumulative updates in 2025–2026.Check if the update has been applied
Open PowerShell as an administrator, then paste and run the following commands:
Check for the 2011 certificate:
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Microsoft Windows Production PCA 2011')
Check for the 2023 certificate:
([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023')
Check if the BIOS is Up to Date
According to information disclosed by the GEEKOM R&D department, as of March 19, 2026, the BIOS versions for the following models (and newer) already support the UEFI 2023 certificate. Updates for other models will also be completed before the UEFI 2011 security certificate expires.
| Intel Series | BIOS Version | AMD Series | BIOS Version |
| Air12 Lite | 0.17 | A5 U Series （5825u 7430u） (65W Adapter) | 2.43 |
| Mini Air12（N95) | 0.44 | A5 7640hs | 0.01 |
| IT12 | 2.34 | A5 Pro | 2.43 |
| IT13 | 1.23 | A5 Pro（7640HS） | 0.02 |
| GT12 Pro | 2.34 | AE7 | 0.54 |
| GT13 Pro | 1.21 | AE8 | 0.57 |
| XT12 Pro | 2.33 | A7 7940HS A7 7535HS | 0.58 |
| XT13 Pro | 1.22 | A8 | 0.61 |
| IT1 Mega | 0.68 | A6 | 2.39 |
| IT13 Max | 0.68 | AX7 Pro | 0.54 |
| IT15 Max | 0.68 | AX8 Pro | 0.56 |
| GT1 Mega | 0.68 | AE8 Max | 1.22 |
| GT13 Max | 0.68 | A7 Max | 1.26 |
| GT15 Max | 0.68/0.14 | A8 Max | 1.22 |
| XT1 Mega | 0.68 | AX8 Max | 1.22 |
| A9 Max | 0.25 | |
| A9 Mega | 0.09 |
Comments
0 comments
Article is closed for comments.