What are Secure Boot certificates?
Secure Boot, opens an external URL in a new window is a security feature found in modern computers. It ensures that only trusted software is allowed to run when the device is turned on — for example, the genuine Windows boot loader, rather than malware.
To make this work, the computer uses digital certificates.
Why are these certificates expiring?
Digital certificates always have a limited validity period so that they can be renewed regularly and security remains up to date. The most important Microsoft Secure Boot certificates from 2011 will expire at the end of June 2026.
How are the certificates renewed?
Ideally, these certificates are automatically renewed when the operating system is updated. This may involve updates to Linux or Windows. In some cases, however, you may need to initiate these updates manually, or, in rare instances, update the BIOS.
What happens if the update isn't installed in time?
Depending on your settings and operating system, the consequences can range from “none” to “the computer no longer starts up.” In addition, future security updates may not install at all or may be difficult to install. It is therefore strongly recommended that you install the updates before June 30, 2026.
How can I make sure my computer doesn't need any updates?
All computers maintained by CIT are automatically updated via the client management system. If any issues arise during this process, we will contact you.
For self-managed Windows computers (with administrative privileges), CIT provides the SecureBoot Certificate Check Tool via the TUtoolbox, opens an external URL in a new window. This tool allows you to easily check the status and initiate the update if necessary. The tool is provided without support from CIT.
On Linux, whether the certificates are used and whether there is a graphical interface or a command-line tool for verification depends on the distribution. Since implementation varies widely across Linux distributions, we are unfortunately unable to offer centralized support for this at this time. However, we are happy to refer you to the OpenTUChat on Matrix, opens an external URL in a new window, where experience has shown that support is available.
Please note the following before performing a manual update
Before performing a manual update, check to see if there are any known issues with your hardware. Also, make sure you have your BitLocker recovery key, opens an external URL in a new window on hand.
Further information
For more information, visit the CIT Downloads and Help, opens an external URL in a new window page.
The following links lead to external websites. Please use the information at your own risk.