Microsoft is replacing digital certificates used by Windows to connect securely to its update servers. The current certificates expire on May 17 and June 19, 2027. PCs that do not receive the replacement certificates may lose access to Windows Update and stop receiving fixes through the service.
Most supported Windows systems should receive the certificates through regular updates. This change will not stop Windows itself from working, but it could leave an unpatched device without updates.
Which devices need updates
- Windows 11 version 25H2 and later: No action required.
- Windows 11 24H2 and Windows Server 2025: Install the September 2025 security update or a later update by June 19, 2027.
- Other supported Windows 10 and 11 versions, and Windows Server 2022: Install the July 2026 update or later by June 19, 2027.
- Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016: Meet the earlier May 17, 2027 deadline.
Windows relies on these certificates to verify that it is connecting to legitimate update servers. Devices that miss the required updates may be unable to connect after the existing certificates expire. PCs that have been offline, had updates disabled, or are subject to delayed patching policies may be more likely to miss the transition. Microsoft says devices receiving updates through Windows Server Update Services (WSUS) are excluded from the certificate change.
PC owners can check their Windows version under Settings > System > About, then use Settings > Windows Update to install available updates. Bring rarely used or offline computers up to date well before the applicable deadline. For managed devices, check with the organization’s IT team.
Systems running unsupported Windows versions should be upgraded to a supported client or server release. Microsoft says a supported device that misses the deadline may regain access to updates after the required update is installed.