Windows Update certificate rotation in 2027: deadlines and required updates
Certificates used to establish trusted connections to Windows Update expire on May 17 and June 19, 2027. Microsoft has outlined update requirements by Windows version, while devices receiving updates through WSUS are excluded.
MicrosoftMicrosoft says certificates used to establish trusted connections to Windows Update will expire on May 17 and June 19, 2027. Devices must contain the replacement certificates to continue receiving updates after the applicable expiration date.
Most devices running an in-support version of Windows and current with monthly updates require no action or only a limited action, depending on the version. The following update requirements apply before the deadline for each group:
Required updates by Windows version
- Windows 11, version 25H2 and later: No action is required.
- Windows 11, version 24H2, and Windows Server 2025: Install the September 2025 security update or later before June 19, 2027.
- Other in-support versions of Windows 11, Windows Server 2022, and in-support versions of Windows 10: Install the July 2026 security update or later before June 19, 2027.
- Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016: Install the July 2026 security update or later before May 17, 2027.
- Other Windows versions: Upgrade to a supported version of Windows client or Windows Server.
Expiration impact and exception
Devices without the replacement certificates will lose access to Windows Update after the applicable expiration date. The change does not apply to devices receiving updates through Windows Server Update Services (WSUS).
Original publication date
October 8, 2026