Microsoft is replacing the digital certificates used by Windows devices to authenticate Windows Update services, with existing certificates scheduled to expire on May 17 and June 19, 2027. The company announced the transition on October 8, 2026, warning that systems missing the replacement certificates could lose access to Windows Update and stop receiving security patches and other operating system updates. The replacement process is already being handled through Microsoft's regular cumulative security updates. For most users running a supported and updated Windows installation, no manual intervention should be necessary. However, older Windows versions and computers that have not received recent security updates may need attention before the expiration deadlines. The certificates are part of the authentication infrastructure used when Windows communicates with Microsoft's update services. Once the existing certificates expire, devices without valid replacements may be unable to establish the trusted connections required to retrieve updates. Microsoft has established different requirements depending on the operating system version. Windows 11 25H2 and newer, including the recently released Windows 11 26H2, already meet the requirements and need no additional action. Windows 11 24H2 requires the September 2025 cumulative security update or a newer release. Other supported Windows 11 versions and eligible Windows 10 installations must have received the July 2026 security update or later before June 19, 2027.
Certain enterprise and server installations face an earlier deadline. Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016 must receive their applicable certificate updates before May 17, 2027.
Windows Update Certificate Requirements
Operating System
Required Update
Expiration Deadline
Windows 11 26H2
Already Included
No Action Required
Windows 11 25H2
Already Included
No Action Required
Windows 11 24H2
September 2025 Or Newer
June 19, 2027
Other Supported Windows 11 Versions
July 2026 Or Newer
June 19, 2027
Eligible Windows 10 Versions
July 2026 Or Newer
June 19, 2027
Windows 10 Enterprise 2019 LTSC
Applicable Certificate Update
May 17, 2027
Windows Server 2019
Applicable Certificate Update
May 17, 2027
Windows Server 2016
Applicable Certificate Update
May 17, 2027
Windows 10 Systems Without Extended Security Updates May Be Affected
The certificate transition is particularly relevant to Windows 10 computers that stopped receiving security updates when standard support ended in October 2025.
Microsoft's Extended Security Updates program provides eligible Windows 10 devices with continued security maintenance through October 12, 2027. Computers enrolled in ESU can receive the cumulative updates containing the replacement certificates.
Systems that were never enrolled, however, may have missed the July 2026 security update and consequently may not contain the certificates required for continued Windows Update connectivity.
Microsoft warns that unsupported operating system versions can lose access to Windows Update services and recommends upgrading to a supported Windows release. Users maintaining Windows 10 installations should verify their ESU eligibility and installed update history rather than assuming the required certificates are present.
The announcement is separate from Microsoft's Secure Boot certificate renewal program. Secure Boot certificates are involved in validating trusted components during system startup, while the certificates discussed here are used for Windows Update service authentication.
For home users, the simplest precaution is to open Settings, navigate to Windows Update, and review the installed update history. Devices that have received the applicable cumulative security updates should already have the replacement certificates installed.
Organizations managing Windows Server installations, deferred update deployments, or older Windows systems should verify compliance ahead of the relevant deadlines to avoid interruptions to future security update delivery.
Sources: Microsoft, Notebookcheck
