Microsoft says Windows devices must receive replacement security certificates before existing Windows Update certificates expire on May 17 and June 19, 2027. Most PCs that install monthly updates should transition automatically. Systems that miss the required update—or run an unsupported Windows version—could lose access to Windows Update and stop receiving security fixes through the service.
Key takeaways
The certificate rotation affects how Windows verifies its connection to Microsoft’s update servers; it does not mean Windows itself will stop working. For most users, installing the relevant update before the deadline is the key step.
- Windows 11 version 25H2 and later require no action, according to Microsoft.
- Windows 11 24H2 and Windows Server 2025 need the September 2025 security update or later by June 19, 2027.
- Other supported Windows 10 and 11 releases, plus Windows Server 2022, need the July 2026 update or later by June 19, 2027.
- Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016 face an earlier May 17, 2027 deadline.
Why the certificates matter
Windows uses digital certificates to verify that it is communicating with legitimate Windows Update servers. As part of routine security maintenance, Microsoft is replacing certificates that are set to expire in 2027. Devices that do not receive the replacement certificates may no longer be able to connect to the update service once the old certificates expire.
That could leave affected PCs without updates delivered through Windows Update, including security fixes. This is particularly relevant for machines that have been offline, had updates disabled, or are managed under policies that delay or restrict patching. Microsoft says unsupported Windows versions should be upgraded to a supported client or server release.
Which devices need attention
Most systems on supported Windows releases should receive the certificates as part of regular security updates. Windows 11 25H2 and newer are listed as requiring no action. For other systems, administrators and owners should verify the device’s version and update history rather than assume that automatic updating has completed successfully.
Enterprise administrators should inventory older devices, confirm that required updates have been deployed, and plan upgrades for unsupported systems. Microsoft says devices receiving updates through Windows Server Update Services (WSUS) are excluded from this certificate change. Supported systems that miss the deadline may be able to restore access by installing the required update afterward.
What PC owners should do
Check the Windows version under Settings > System > About, then review Settings > Windows Update and install available updates. For PCs that are rarely used or kept offline, connect them and bring them up to date well ahead of the applicable deadline. Managed PCs should be checked with the organization’s IT team, since update timing may be controlled centrally.
For builders and enthusiasts maintaining older rigs, the main practical risk is leaving a system unpatched until after its certificate deadline. If a PC is running an unsupported version, updating alone may not be enough; Microsoft recommends moving to a supported Windows client or server version. Regular patching now should prevent the certificate rotation from interrupting updates later.