Last year's end-of-support deadline for Windows 10 was a big test for consumers and IT pros alike. The good news is, everyone passed! The bad news is, there's another crucial expiration date right around the corner.

Every Windows PC designed and built since 2011 supports a feature called Secure Boot. This feature, which is on by default on new PCs sold with Windows 10 and Windows 11, acts as a gatekeeper that allows only trusted software to run at startup. If someone tries to tamper with the operating system or boot from an alternate device, Secure Boot blocks that attempt.

All currently supported versions of Windows support Secure Boot, as do an increasing number of Linux distributions, including Ubuntu, Fedora, Linux Mint, OpenSUSE, and a host of others.

Secure Boot relies on a chain of cryptographic certificates that verify each boot component's signature. One of the most important certificates is the Key Exchange Key (KEK), which sits in the UEFI firmware and works with the Trusted Platform Module (TPM) to manage the list of trusted bootloaders, which are contained in the Allowed Signature Database (DB) and the Forbidden Signature Database (DBX).

The Microsoft-issued Production Certificate Authority (CA) and UEFI CA certificates are also essential to the operation of Secure Boot and also need to be updated.

Also: Microsoft is finally bringing the movable taskbar to Windows 11 - here's who can try it now