Windows 10 End of Life: Navigating the 2026 Secure Boot Certificate Expirations

Windows 10 support and Secure Boot certificate renewal are separate issues. Standard Windows 10 support ended on October 14, 2025. Microsoft Secure Boot certificates issued in 2011 began reaching expiry in June 2026. A PC may need both an operating-system support plan and certificate/firmware updates.

This guide was checked on October 3, 2026. Enrollment in ESU alone is not proof that a PC's Secure Boot certificates have been updated.

When Did Windows 10 Support End?

Standard support for Windows 10 ended on October 14, 2025. ESU supplies a limited set of security fixes for eligible enrolled devices; it does not restore the full support service or add new Windows features. Separate lifecycle dates apply to certain LTSC products.

What Is the 2026 Secure Boot Certificate Expiration?

Secure Boot checks software in the boot process against trusted certificates. Microsoft's replacement certificates were issued in 2023. Without the update, a PC normally continues to start and run, but loses access to new boot-security protections that require the replacement trust entries.

Most personal PCs receive the change through Microsoft-managed updates. Some need an OEM firmware update, and organization-managed PCs need an administrator to follow the deployment guidance. Neither a new PC's purchase date nor ESU enrollment guarantees completion. Microsoft explains the expiry behavior and update requirements.

Do not disable Secure Boot to work around expiry. Check the actual update status and the manufacturer's supported firmware. For practical verification steps, see our Secure Boot certificate update guide alongside Microsoft's current deployment instructions.

Two Dates Worth Knowing

The consumer extension does not extend ordinary Windows 10 support or authorize business use of consumer ESU.

What Should IT Teams Do?

Path 1: Enroll in Commercial ESU

For PCs that must temporarily remain on Windows 10, confirm the eligible version, required updates, license, and enrollment. Microsoft's published commercial starting price is $61 per device for Year 1, doubling in subsequent years. Prior years must also be purchased if enrolling later. A full three-year license-only example is $61 + $122 + $244 = $427 per device.

Some cloud scenarios have separate ESU benefits; check the eligibility rather than assuming that any Windows 365 subscription covers every physical endpoint. See Microsoft's commercial ESU documentation.

Separately verify Secure Boot certificate status and any OEM firmware requirements. Use the current certificate-renewal deployment guidance; KB5025885 concerns a separate Secure Boot mitigation process and should not be used as a universal certificate-renewal recipe.

Path 2: Plan a Windows 11 Hardware Migration

Use Microsoft's PC Health Check guidance to assess compatibility. Windows 11 requires a supported processor and other capabilities in addition to TPM 2.0.

To inspect TPM status, press Windows Key + R, enter tpm.msc, and check Specification Version. A 2.0 result meets the TPM requirement only. A missing TPM may be disabled in firmware; consult the manufacturer before deciding the PC must be replaced. Do not change firmware settings without checking recovery-key and backup preparation.

See our Windows 11 system requirements guide and hardware refresh planning guide.

What Should Home Users and Small Businesses Do?

Option 1: Enroll in Consumer ESU for Personal Use

Microsoft's current consumer ESU page lists coverage through October 12, 2027, including continuation for devices already enrolled. It describes no-cost enrollment by syncing PC settings, enrollment with 1,000 Rewards points, or a one-time $30 payment plus applicable tax. A linked Microsoft account can cover up to ten eligible personal devices. Regional availability and terms can differ.

On Windows 10, use Settings > Update & Security > Windows Update to check enrollment. Verify the eligible edition, version, account, and current updates against Microsoft's instructions.

Consumer ESU cannot be used in commercial scenarios. Small offices must use the appropriate business program; running Home or Pro does not turn a business PC into an eligible personal device. Do not assume EEA enrollment is automatic or account-free; check Microsoft's local terms.

Option 2: Upgrade to Windows 11

If compatible, plan the upgrade with application checks, backups, and recovery preparation. Confirm the edition your management setup requires. Our Home vs. Pro and Pro vs. Enterprise guides explain the licensing distinctions.

Option 3: Replace the Hardware

If the PC cannot run the required supported environment, obtain a replacement quote and compare it with the cost of temporary ESU and continued support. Set a migration date rather than treating ESU as a permanent solution.

Review Business Laptop Options

Should You Upgrade Windows or Replace Your PC?

Use the complete compatibility assessment, business application requirements, warranty, and support costs to decide. An upgrade can be appropriate on supported hardware; replacement may be appropriate when compatibility or reliability prevents it. Verify certificate renewal either way.