In June 2026 Secure boot certs start to going to expire for physical en virtual machines Servers en Clients. PS not only Windows but also Linux!!
PS. Make sure Client en Servers all installed with latest updates!!
Made a little Risk Assessment:
The expiration and replacement of Microsoft Secure Boot certificates pose a high risk to IT environments. If not properly managed, systems may fail to boot, updates may fail, and security risks may increase. This is particularly critical in automated and virtualized environments.
Key risks:
Recommended actions:
A phased rollout and proper validation are essential to prevent disruptions.
1. Scope
This document describes the risks, impact, and mitigations related to the expiration of Microsoft Secure Boot certificates in enterprise environments.
2. Affected Components
3. Risk Analysis
Key risks:
4. Risk Matrix
5. Mitigations
6. Validation & Testing
7. Conclusion
Changes to Secure Boot certificates must be treated as critical infrastructure updates. Proper preparation, testing, and phased implementation are essential to avoid disruptions.
Microsoft has released patch’s for the following OS.
Windows 11 (23H2/24H2/25H2)
Windows Server 2016/2019/2022/2025.
VMware is creating a “Fix or Update” for this
* I did not test versions with extended support like Windows 2012 R2 and Windows 10.
Get your list with:
Get-VM | Where-Object { $_.ExtensionData.Config.Firmware -eq “efi” -and
$_.ExtensionData.Config.BootOptions.EfiSecureBootEnabled } | Select-Object Name,
@{N=”OS”;E={$_.ExtensionData.Guest.GuestFullName}}, PowerState
There is a updated coming from VMware by Broadcom: Check this article: @{N=”OS”;E={$_.ExtensionData.Guest.GuestFullName}}, PowerState
https://knowledge.broadcom.com/external/article/423893
Extra Info
Microsoft Info:
I hope that most People have Read: Windows Secure Boot certificate expiration and CA updates
and Secure Boot playbook for certificates expiring in 2026
Redhat:
Secure Boot Certificate Changes in 2026: Guidance for RHEL Environments
Broadcom:
Secure Boot Certificate Expirations and Update Failures in VMware Virtual Machines
Manual Update of the Secure Boot Platform Key in Virtual Machines