Secure Boot Certificate Expiration and SmartDeploy
Microsoft is updating the Windows Secure Boot certificates originally issued in 2011, several of which begin expiring in June 2026. This article explains what those changes mean for SmartDeploy workflows and what actions you may need to take.
What is Secure Boot?
Secure Boot is a UEFI firmware feature that verifies the digital signatures of pre-boot software against a set of trusted certificates before allowing them to run. It protects against bootkit malware by ensuring only trusted, signed code executes during the boot process.
Microsoft manages a set of certificates stored in the device firmware that control which boot software is trusted. These certificates are organized into:
- KEK (Key Enrollment Key): Controls the ability to update the trusted and revoked signature databases.
- DB (Allowed Signature Database): Contains certificates for trusted boot software, including the Windows Boot Manager.
- DBX (Revoked Signature Database): Contains revoked certificates and hashes that are blocked from executing.
Which Certificates Are Expiring?
The following Microsoft-managed certificates are expiring in 2026:
| Expiring Certificate | Expiration Date | Replacement Certificate |
|---|---|---|
| Microsoft Corporation KEK CA 2011 | June 24, 2026 | Microsoft Corporation KEK 2K CA 2023 |
| Microsoft UEFI CA 2011 | June 27, 2026 | Microsoft UEFI CA 2023 |
| Microsoft UEFI CA 2011 | June 27, 2026 | Microsoft Option ROM UEFI CA 2023 |
| Microsoft Windows Production PCA 2011 | October 19, 2026 | Windows UEFI CA 2023 |
Devices that have not received the updated 2023 certificates before expiration will continue to start and operate normally, and standard Windows updates will continue to install. However, those devices will lose the ability to receive new Secure Boot protections, including updates to the Windows Boot Manager, revocation lists, and mitigations for newly discovered boot-level vulnerabilities.
How This Affects SmartDeploy
SmartDeploy uses a custom pre-installation environment (SmartPE) to boot target devices for imaging and deployment. SmartPE is built from Windows PE components, and the boot media SmartDeploy creates, including USB media, WDS boot images, ISO media, and deployment packages, contains a Windows Boot Manager that must be trusted by the device's Secure Boot configuration.
Here is where the certificate expiration can create problems:
Boot Media Created Before the Certificate Updates
If you created SmartDeploy boot media (USB, WDS, ISO, or deployment package) before SmartDeploy releases updated boot images signed by the new 2023 certificates, that boot media may fail to boot on devices whose firmware has been updated to trust only the new certificates. Devices that already received updated DB entries via Windows Update may no longer recognize boot media signed with the expiring 2011 certificates.
What to do: Recreate your boot media using the SmartDeploy Media Wizard after SmartDeploy releases updated, 2023-signed boot components. Watch for SmartDeploy release notes and update announcements on the Release Notes and Schedule
Platform Packs
Platform Packs contain Windows PE drivers and platform-specific components that are injected into SmartPE at boot media creation time. Platform Packs themselves do not contain signed boot components and are not directly affected by Secure Boot certificate expiration. Platform Packs downloaded before the certificate transition are still valid and do not need to be re-downloaded for this reason alone.
WDS Deployments
If you use SmartDeploy with Windows Deployment Services (WDS), your WDS boot image contains the same SmartPE boot components as USB or ISO media. The same guidance applies: after SmartDeploy releases updated boot components, you should regenerate your WDS media using the SmartDeploy Media Wizard and re-import the updated WIM into WDS.
Console-Initiated Deployments (Deployment Packages)
Deployment Packages are distributed by the SmartDeploy Console to endpoints that have the SmartDeploy Client installed. These packages contain a SmartPE WIM file. If your endpoints receive updated Secure Boot firmware that no longer trusts the 2011 certificates, your existing deployment packages will need to be recreated with updated, 2023-signed boot components.
Reference Virtual Machines
Building your reference VM is not directly impacted by Secure Boot certificate expiration, since image capture happens inside a running OS rather than from a Secure Boot boot sequence. However, if your reference VM has Secure Boot enabled and its firmware is updated to require the new certificates, verify that your hypervisor supports the updated certificate chain. In most cases this is handled automatically by the hypervisor and the VM's UEFI firmware.
What You Should Do
Check whether your devices will receive the updated certificates automatically
Most Windows devices managed through Windows Update will receive the new 2023 certificates automatically. If your organization uses IT-managed updates (WSUS, SCCM, Intune, or similar), review Microsoft's IT Pro guidance to confirm whether certificate updates will be pushed to your endpoints and when:
- Secure Boot Certificate Updates: Guidance for IT Professionals and Organizations
- Registry Key Updates for Secure Boot
- Group Policy Method for Secure Boot Updates
Keep SmartDeploy updated
SmartDeploy has released the updated boot components signed with the new 2023 certificates in our 3.02060 release. Please remember to recreate your boot media after updating to this version.
You can download the latest version of SmartDeploy at any time from app.smartdeploy.com. For most major releases, you will also see an in-app notification prompting you to update.
Recreate boot media after SmartDeploy updates
Once SmartDeploy releases a version with updated, 2023-signed boot components:
- Update SmartDeploy to the latest version.
- Open the Media Wizard and recreate your USB media, WDS media, ISO files, or deployment packages.
- For WDS environments, re-import the updated WIM into your WDS server and update any multicast settings or answer files as needed.
Integrate SmartDeploy with Windows Deployment Services
Test before rolling out to production
Before deploying widely, test your updated boot media on a representative set of endpoint models, particularly those that may have already received the updated Secure Boot firmware from Windows Update or a firmware update from the device OEM (Dell, HP, Lenovo, etc.).
Frequently Asked Questions
Will my existing deployments break immediately when the certificates expire in June 2026?
Not necessarily all at once. Devices only stop trusting the old boot media after their firmware has been updated to require the new certificates. Devices that have not received the updated DB and KEK will continue to boot existing SmartDeploy media normally. However, once any device in your environment receives the updated firmware, that device will require updated SmartDeploy boot media.
Do I need to do anything to my captured images?
No. Your captured WIM images are not affected by Secure Boot certificate expiration. Only the boot media (the SmartPE boot environment) is impacted.
Do I need to update my Platform Packs?
Platform Packs do not contain Secure Boot signed components and do not need to be updated specifically for this change. However, platform packs do contain firmware updates, which might help improve your organizations readiness for these changes.
My devices use BitLocker. Is there any additional concern?
Yes. Microsoft notes that Secure Boot certificate expiration can limit BitLocker hardening over time on devices that have not received the updated certificates, since BitLocker's highest security profile relies on Secure Boot integrity. Ensure your endpoints receive the updated certificates as part of your normal patch and firmware management process. See Microsoft's guidance on BitLocker and Secure Boot for details.
Where can I see SmartDeploy release notes and updates?
Additional Resources
