senn-techWindows Update certificates expire in May and June 2027
Microsoft is replacing the certificates Windows Update uses to identify itself to devices. One set expires on 17 May 2027 and another on 19 June 2027. Microsoft announced it on 8 October 2026, and Deskmodder and BleepingComputer covered it on 9 October. Certificates have an expiry date and must be replaced at some point, Microsoft writes; it calls that standard security practice. On most devices the swap happens automatically. Anyone running their own servers and older clients should know their patch level before the deadlines.
Which version needs what
The detailed list by Windows version, as BleepingComputer takes it from Microsoft:
| Version | Action | Deadline |
|---|---|---|
| Windows 11 25H2 and later | none | none |
| Windows 11 24H2, Windows Server 2025 | September 2025 security update or later | 19 June 2027 |
| Other supported Windows 11, Windows Server 2022, Windows 10 | July 2026 security update or later | 19 June 2027 |
| Windows 10 Enterprise 2019 LTSC, Windows Server 2019, Windows Server 2016 | July 2026 security update or later | 17 May 2027 |
| All other Windows versions | move to a supported version | before May and June 2027 |
Deskmodder summarizes more coarsely: users of Windows 11 26H2 and 25H2 need to do nothing, 24H2 and Server 2025 need the September update, older Windows 11 versions, Windows 10 and Server 2022, 2019 and 2016 need at least the July update. Deskmodder names both dates but assigns neither to a version. For planning, BleepingComputer's table is the one to use.
What happens with an outdated device
BleepingComputer reports Microsoft's statement that devices on unsupported Windows versions lose access to the Windows Update services and receive no updates. For supported devices that lack the required level, Deskmodder explains that Windows Update then stops delivering new updates and only the Microsoft Update Catalog helps. Deskmodder says the certificate arrives with the manually installed update.
BleepingComputer also notes that Microsoft's guidance does not apply to devices that get their updates from WSUS. The report does not explain exactly what that means. Anyone using WSUS should read Microsoft's original text instead of concluding from the summary that the deadline does not concern them.
What to do now
Microsoft recommends three steps to administrators. First, identify all devices on older or unsupported Windows versions. Second, install the monthly updates on all supported devices. Third, plan a move to a supported version for unsupported devices before May and June 2027.
The first step is the laborious one. A list of all servers and clients with Windows version and installed update level can be pulled from software distribution or from the inventory. Servers on 2016 and 2019 are the candidates with the earlier deadline of 17 May 2027. Around seven months of lead time until then sounds like plenty, but for a fleet with fixed maintenance windows it is often tighter than it looks.
Further reading
- Microsoft: Outdated Windows devices will stop receiving security updates (BleepingComputer, 9 October 2026): deadlines, version table, Microsoft's recommendations
- Windows Update-Zertifikate werden ausgetauscht (Deskmodder, 9 October 2026, German): summary and the Update Catalog route
- Microsoft logo on Wikimedia Commons: logo
.svg){kind=link}
When do the Windows Update certificates expire?+
According to Microsoft, one set of certificates expires on 17 May 2027 and another on 19 June 2027. They are being replaced with new certificates, which supported Windows versions already receive through Windows Update.
Which update do Windows 11 24H2 and Windows Server 2025 need?+
The September 2025 security update or a later one, installed before 19 June 2027. For Windows 11 version 25H2 and later, Microsoft says no action is required.
What happens to devices that are not up to date?+
After the expiry they no longer receive updates through Windows Update. On unsupported Windows versions, access to the update services is lost. For supported devices that fall behind, Deskmodder says the Microsoft Update Catalog remains the way.