how do i get a new secure boot certificate

Secure Boot certificates for Windows 10 are not obtained manually like a typical PKI certificate; they are delivered and updated through Windows and firmware updates.

For Windows 10 devices, there are two primary paths:

1. Microsoft-managed devices (typical personal or small-business PCs)
   • Secure Boot certificates are updated automatically via Windows Update.
   • No separate request or manual certificate enrollment is required.
2. Organization/IT-managed devices
   • IT administrators are responsible for deploying the updated Secure Boot certificates following Microsoft’s guidance in the Secure Boot update documentation.
   • The process typically involves:
     • Ensuring the device is on a supported Windows version listed in the Secure Boot guidance.
     • Applying the cumulative updates that include the new Secure Boot certificates.
     • Applying any required OEM firmware updates so the firmware can accept and store the new certificates.
   • The guidance is provided in the “Windows Secure Boot certificate expiration and CA updates” and “Secure Boot Certificate updates: Guidance for IT professionals and organizations” documentation referenced in the context.

If the device is already running Windows and can install updates, the new Secure Boot certificates are written into firmware as part of those updates, even if older certificates are expired. For virtualized environments, either the virtualization platform provides updated virtual firmware with the new certificates, or Windows applies them if the virtual firmware supports Secure Boot updates.

To remain protected:

• Keep Windows 10 fully updated with the latest cumulative updates.
• For IT-managed fleets, follow the Secure Boot certificate update guidance and coordinate with the OEM for any necessary firmware updates.

There is no separate “download a certificate file” step; the supported method is to consume the Microsoft-provided updates that carry and install the new Secure Boot certificates.

References:

• Frequently asked questions about the Secure Boot update process
• Secure boot
• When Secure Boot certificates expire on Windows devices
• Secure Boot Certificate updates: Guidance for IT professionals and organizations
• Windows Secure Boot Key Creation and Management Guidance