How to Check If Your Secure Boot Certificate Has Expired

Secure Boot is a UEFI security feature that helps protect your computer from bootkits and other malware by allowing only trusted software to load during startup. It relies on a set of digital certificates stored in your system firmware.

When these certificates expire, your computer will continue to boot normally. However, it will lose the ability to receive future Secure Boot updates, revocations for bootkits, and new security fixes for the boot process.

That’s why, devices that stay updated are fine, but checking and updating system are also important. This guide explains how to verify whether your Secure Boot certificates are still valid in Windows.

Steps to Check Your Secure Boot Certificate Status

The easiest way to check is through the Windows Security app.

Step 1. Open Windows Defender

Search “Windows Security” in the Search bar and click the matching result to open the app.

Step2. Select Device Security

On the Windows Security window, go to the Device security page.

Step 3. Check the Status

Look the icon next to the Secure boot section.

• If you see a green checkmark and "all required certificate updates have been applied”, you don’t need to take any certificate changes.

• If you see a yellow or red warning, that means your certificates are outdated, and you need to take further actions.

What If Your Secure Boot Certificate Is Outdated

If your Secure Boot certificates are no longer current:

• Update your motherboard or laptop BIOS/UEFI firmware.

• Install the latest Windows security updates.

• Load the factory default Secure Boot keys from your BIOS if they have been modified or deleted.

• Contact your PC or motherboard manufacturer if updated Secure Boot keys are unavailable.

NOTE: Avoid manually replacing Secure Boot keys unless you fully understand the implications, as incorrect changes can prevent your system from booting.

Conclusion

Secure Boot certificates are an essential part of your PC's startup security. While Windows doesn't provide a simple tool to display certificate expiration dates, you can verify Secure Boot status by this simple method to ensure your certificates remain current. Keeping Windows Update enabled is the best way to maintain Secure Boot compatibility and protect your system against newly discovered threats.