Your PC restarted twice during an update instead of once, or you have read that something called Secure Boot expires this year, and neither of those came with an explanation.
Good news: the machine keeps working either way. Microsoft says so plainly, and the difference it makes is narrower than the word expire suggests.
I read what this machine reports about Secure Boot before writing, and one of the two checks I wanted turned out to need an administrator I was not going to become.
What is actually expiring
Certificates, not the feature. The distinction is the whole article.
⭐ Microsoft says the original Secure Boot certificates expire in June and October 2026 on its certificate expiration page. Those are the ones most PCs shipped with.
⚡ Newer 2023 certificates replace them. Same job, later expiry date, and they arrive through updates rather than as a thing you buy.
⚠️ Secure Boot itself is not going anywhere. It carries on doing what it does, with whichever certificates the machine holds.
⛔ October 2026 is the second of those two dates, which is why this is being talked about now rather than next year.
What happens if your PC misses it
The reassurance, and it comes straight from Microsoft rather than from me.
⭐ Microsoft states it directly: devices that have not received the newer certificates "will continue to start and operate normally, and standard Windows updates will continue to install".
⚡ So nothing stops. Not the machine, not Windows Update, not your programs.
⚠️ What you lose is narrower: those devices "will no longer be able to receive new security protections for the early boot process".
⛔ Early boot means the seconds before Windows starts. Real, worth having, and not the same as being unprotected day to day.
Is that extra restart this?
Probably, and Microsoft warned about it two days ago.
⚡ Microsoft says that with recent and upcoming updates, "a limited number of consumer and business devices might experience one additional restart during installation".
⭐ It names the cause: the restart "occurs after a Secure Boot certificate update is applied as part of the Secure Boot update process".
⚠️ One time, not every month. That is Microsoft's own wording and it is the part people worry about.
⛔ An update that restarts twice and then finishes is behaving correctly. An update that never finishes is a different thing entirely.
What this machine reports, and what it would not tell me
Ours, including the half I could not get.
⭐ Secure Boot is on here. Windows records it in the registry and it reads as enabled, with no administrator needed.
⚡ Read yours the same way, in Terminal:
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\State" | Select-Object UEFISecureBootEnabled⚠️ A 1 means on. A 0 means off, and no key at all usually means the machine is not using UEFI.
⛔ The second check refused me. ⚠️ Reading which certificates the firmware actually holds needs an administrator, so this page does not claim to know whether the 2023 ones are present here.
What you can do without an administrator
Three things, and all three are the ordinary advice for once.
⚡ Install updates when they are offered. Microsoft says most devices receive the updated certificates automatically.
⭐ Let the machine restart when it asks. The certificate step happens during installation and an interrupted update is worse than a slow one.
⚠️ Check your maker's support page for firmware. Microsoft says "many OEMs provide firmware updates when needed", which is the part Windows Update cannot do for you.
⛔ A firmware update is not the same as a driver update. Most driver updates are unnecessary. This kind is not.
When it is worth doing more
Ours, and for most people the answer is that it is not.
⭐ A home PC that installs updates needs nothing else. That is genuinely the whole plan.
⚡ A machine that has been offline for a year is the one to think about. It has missed the run up as well as the certificates.
⚠️ And a PC old enough to predate Secure Boot is not affected, because it never had these certificates in the first place.
⛔ If you are about to change the motherboard, that is a separate matter worth reading first. The Windows license is the thing at risk there.
Status: Secure Boot state read from the registry here on 29 August 2026, on a 25H2 laptop, against Microsoft's own certificate expiration page and its August 2026 message center note. ⛔ Nothing was changed, no firmware or boot setting was written or read with elevation, and no make, model, firmware version or identifier is published.
What happens when Secure Boot certificates expire?
Microsoft says devices that have not received the newer 2023 certificates will continue to start and operate normally, and that standard Windows updates will keep installing. What those devices lose is the ability to receive new security protections for the early boot process, which is the part before Windows starts.
Why did my PC restart twice during an update?
Microsoft has said that with recent and upcoming updates a limited number of devices might see one additional restart during installation, and that it happens after a Secure Boot certificate update is applied. It is a one time restart rather than something that repeats every month.
Do I need to do anything about Secure Boot in 2026?
For most people, no. Microsoft says most devices receive the updated certificates automatically. Install updates when offered, let the machine restart when it asks, and check your manufacturer's support page for firmware updates, because that part is outside Windows Update.
How do I check if Secure Boot is on?
One line in Terminal reads it from the registry without needing an administrator. A value of 1 means Secure Boot is enabled, 0 means it is off, and a missing key usually means the machine is not booting in UEFI mode. Reading which certificates the firmware holds needs elevation.
The Short Version
- The certificates expire in June and October 2026. Secure Boot does not.
- Microsoft says affected devices keep starting and updating normally.
- What they lose is new security protections for the early boot process.
- An extra one time restart during an update is the certificate step.
- Most devices get the new certificates automatically through updates.
- Some machines also need a firmware update from the maker.
- One line reads whether Secure Boot is on, with no administrator needed.
- Reading which certificates are present does need an administrator.
Where to Next
Run the one line check and confirm Secure Boot is on. That is the part you can see for yourself.
Install any updates you have been postponing, because the certificates arrive with them.
Let the machine restart when it asks, even if it asks twice on one update.
Look up your laptop or motherboard on the maker's support page and see whether a firmware update is offered.
And if your PC restarted twice on a single update this month, say which model in the comments. Nobody is collecting which machines are seeing it.
Isaac Smith is the founder and editor of PC Glance, a website that covers computers, laptops, and technology. He is a tech enthusiast and a computer geek who loves to share his insights and help his readers make smart choices when buying tech gadgets or laptops. He is always curious and updated about the latest tech trends.