Certificate migration is the controlled replacement of older cryptographic trust material with newer certificates. In practice, this means updating systems, devices, or firmware so they continue to trust the right signing keys without breaking verification. In security terms, it is a trust-chain maintenance task: if a certificate expires or becomes obsolete, software that depends on it can stop validating code, updates, or boot components correctly.
This matters because attackers often target trust anchors. If old certificates are left in place too long, defenders may face failed validation, weakened trust in secure boot, or gaps in update delivery. Migration is common in operating systems, PKI, code signing, and firmware rollouts, where administrators stage changes carefully and verify coverage before old trust material ages out. Done well, it preserves continuity while closing off stale trust paths that attackers could abuse.