Microsoft has put administrators and everyday users on notice: digital certificates that authenticate Windows Update servers will expire in mid-2027, and any machine missing the replacement certificate will stop receiving security fixes.
The deadlines fall on May 17 and June 19, 2027, depending on the Windows version in use. Microsoft is pushing the new certificates through its normal monthly update channel, so most supported machines will receive them automatically. But stragglers—especially older or unmanaged devices—will quietly lose their update lifeline if nothing is done.
Which versions need what
The exact required update depends on which Windows build is running. Windows 11 24H2 and Windows Server 2025 need the September 2025 monthly security update, or anything newer, to keep the pipeline alive past June 19, 2027. Other supported Windows 11 editions and Windows Server 2022 share that same expiration date but require the July 2026 monthly update or later.
Supported Windows 10 installs also fall under the June 19, 2027 deadline and the July 2026 update requirement. Long-Term Servicing Channel (LTSC) users face the earlier May 17, 2027 cutoff. Windows 10 Enterprise 2019 (LTSB/LTSC), Windows Server 2019, and Windows Server 2016 all need the July 2026 update installed before that May date.
Machines running Windows builds that are already past their support window will also lose access and cannot recover through normal patching. Microsoft's recommendation: upgrade.
Why this matters
Certificate expiration is the kind of plumbing failure nobody notices until things break. Unlike a ransomware outbreak or a phishing wave, there is no attacker to blame and no malware to clean. The system simply stops talking to itself, and the security updates that patch the next zero-day never arrive.
For home users, the risk is procrastination. A laptop that has been ignoring "Restart to install updates" prompts for six months is the same laptop that will go dark in 2027. For small businesses and IT teams, the risk compounds. Unmanaged endpoints, point-of-sale terminals, factory controllers running Windows, and the usual graveyard of "set up once and forgotten" desktops all sit on the same cliff edge.
Beyond missing patches, there is a secondary cost: future compatibility updates, driver improvements, and new features delivered through Windows Update also dry up. For businesses depending on specific hardware configurations or legacy software, this could force otherwise unnecessary hardware refresh cycles.
Who should care
| User type | Risk level | Action needed |
|---|---|---|
| Home users with Windows 11 25H2+ | Low | None—already covered |
| Home users on older Windows 11/10 | Medium | Confirm updates are installing automatically |
| Small business IT | High | Audit all endpoints; enforce monthly patch cycles |
| Enterprise with WSUS | Low | Verify WSUS chain is healthy and certificates propagate |
| LTSC/LTSB deployments | High | Schedule July 2026 update before May 17, 2027 |
| Unsupported Windows users | Critical | Treat as urgent upgrade situation, not a patching problem |
What to do next
Check every Windows machine you manage today. Confirm that Windows Update is actually running—no ignored prompts, no paused settings. For supported versions, verify at minimum the September 2025 or July 2026 cumulative update has landed. For any device stuck on an unsupported build, the upgrade conversation starts now, not in 2027.
Key takeaways
- Windows 11 25H2 and later require nothing; older builds need specific 2025 or 2026 monthly updates.
- LTSC/LTSB editions (Windows 10 Enterprise 2019, Server 2019, Server 2016) have until May 17, 2027—earlier than most.
- Unsupported Windows installs cannot receive the fix; they must be upgraded.
- WSUS-managed devices are exempt from this certificate change.
- Certificate rotation happens automatically for most supported systems, but only if updates are actually installed.
Frequently asked questions
When exactly do the Windows Update certificates expire?
May 17, 2027 for LTSC/LTSB editions and June 19, 2027 for other supported Windows 11 and Windows 10 builds.
Do I need to do anything if my PC runs Windows 11 25H2?
No. Windows 11 version 25H2 and later already include the replacement certificates and need no action.
What happens if I miss the deadline?
Your machine will lose access to Windows Update, meaning no future security fixes or updates through that channel. Installing the required update afterward restores access on supported builds.
Are WSUS-managed devices affected?
No. Devices receiving updates through Windows Server Update Services are excluded from this certificate change.
Can unsupported Windows versions still get the certificate fix?
No. Unsupported versions cannot receive the replacement through Windows Update and Microsoft recommends upgrading to a supported edition.