Microsoft has clarified that Windows 10 and Windows 11 devices which have not yet received the newer Secure Boot 2023 certificates are not suddenly out of luck. According to the July 2026 Windows update notes highlighted by Windows Latest, those PCs should continue to start normally, install standard Windows updates, and receive the newer certificates through Windows Update over the coming months.

For most home users, the practical takeaway is simple: do not disable Secure Boot, do not make emergency firmware changes, and do not assume your PC is unsupported just because the certificate transition has not completed yet. For IT teams, however, this is a useful reminder that Secure Boot certificate status is now part of endpoint hygiene. The certificate rollout should be treated as a boot-trust hygiene project, not as a one-time Patch Tuesday footnote.

What Microsoft is changing

Secure Boot relies on trusted cryptographic certificates stored and used by UEFI firmware to decide whether early boot components are allowed to run. The original trust chain used across the Windows 8, Windows 10, and Windows 11 era dates back to 2011. Microsoft has been moving supported systems to newer 2023 certificates so that the boot trust model can continue to receive modern revocation updates and remain effective against newer boot-level attacks.

Windows Latest notes that Microsoft’s July 14 changelog for KB5101650 states that devices without the newer certificates will continue to start and install regular Windows updates. Microsoft also says it will keep installing the newer certificates through Windows updates in the coming months. That matters because the rollout is intentionally cautious: firmware compatibility, bootloaders, recovery environments, and some device-specific configurations can all influence when Windows is confident enough to apply the updated trust material automatically.

In other words, the absence of the new certificates today does not necessarily mean a device is broken. It may simply mean Windows is waiting for enough compatibility confidence, or that the device is in a slower deployment group.

Why Secure Boot certificates matter

Secure Boot runs before Windows itself. Its job is to verify that boot components are signed by authorities the firmware trusts. If a bootloader or early startup component does not match the trusted policy, the system can refuse to run it. That early position in the startup chain is why Secure Boot is important: it helps block bootkits and rootkits that try to load before endpoint protection and operating system security controls are active.

The certificates are the foundation of that trust decision. When old certificates age out, Microsoft needs a newer trust path so Windows devices can keep receiving revocation updates, including DBX updates that block known vulnerable or malicious boot components. This is not just theoretical. The BlackLotus UEFI bootkit showed how attackers could abuse older bootloader weaknesses to bypass Secure Boot protections on systems that otherwise appeared patched. Keeping the Secure Boot trust chain current helps Microsoft close off similar paths as new threats emerge.

What administrators should check now

Administrators should first identify which Windows devices have Secure Boot enabled and which have completed the certificate transition. Windows Security can show Secure Boot status under Device Security, and enterprise teams may also inventory status through endpoint management, scripting, or security tooling. The key is to avoid relying on assumptions. A laptop model that updated cleanly in one hardware revision may behave differently in another firmware branch.

Next, check firmware and BIOS update practices. Secure Boot lives at the boundary between Windows and firmware, so stale firmware can slow or complicate trust-chain updates. Devices that are still in service should be on vendor-supported firmware where possible, especially business laptops and desktops that are expected to remain in production through late 2026 and beyond.

IT teams should also review recovery media and imaging workflows. If you maintain custom Windows images, bootable repair drives, deployment environments, or third-party encryption and recovery tools, validate them on hardware that has received the new certificates. The worst time to discover a boot trust mismatch is during an outage, a bare-metal restore, or a remote recovery event.

What users should avoid

Users may be tempted to “fix” a warning by turning Secure Boot off. That is usually the wrong move. Disabling Secure Boot reduces protection against attacks that target the pre-OS startup path, and it may create compliance issues for managed devices. Unless a vendor or administrator specifically instructs otherwise, Secure Boot should remain enabled.

Likewise, users should be careful with unofficial registry tweaks, firmware resets, or bootloader modifications promoted as shortcuts. Secure Boot certificate updates are sensitive because they affect whether a machine can start trusted software. Microsoft’s staged rollout is designed to reduce the risk of disruption, and forcing changes outside supported channels can create more problems than it solves.

Practical bottom line

The July clarification is reassuring, but it should not be ignored. Microsoft is saying that devices still waiting for Secure Boot 2023 certificates will keep booting and receiving normal updates while the deployment continues. That removes the need for panic, but it does not remove the need for visibility.

For Windows enthusiasts, the best response is to keep Windows Update current, install firmware updates from the device maker, and leave Secure Boot enabled. For IT departments, the right response is to inventory certificate status, prioritize firmware currency, test recovery workflows, and watch Microsoft’s future servicing notes. Secure Boot is one of those protections that works best when it is boring, current, and verified before there is an incident.

Source: Windows Latest