Certificate expiry threatens Windows Update access for unpatched PCs
Microsoft is telling Windows users and administrators to install updates before the certificates that authenticate Windows Update servers expire in May and June 2027. Devices that do not receive the replacement certificates will be cut off from Windows Update, including security patches, though supported systems can regain access later by installing the required update. Most current, updated Windows installations should get the new certificates automatically, while some supported versions need specific updates and WSUS-managed devices are exempt.
Microsoft is issuing replacement certificates through a rotation process. The old ones stop being valid on May 17 or June 19, 2027, depending on the Windows release. Supported devices that stay updated should get the new certificates without intervention. Windows 11 25H2 and later require nothing; 24H2 needs the September 2025 security patch or a newer one.
Other supported editions need the July 2026 update or later. Unsupported editions should be upgraded. Machines managed through WSUS are not affected. A supported device that misses the cutoff can regain Windows Update access by installing the necessary update from Microsoft's catalog or via management tools.
If devices are cut off, they may miss fixes for known flaws, potentially raising compromise risk. Organizations with older or lagging systems could face more manual remediation, while WSUS users may avoid disruption. Consumers on unsupported PCs may need upgrades or risk reduced protection. The broader effect may be uneven, depending on update status and management practices.