Windows update certificates expire in 2027: what to check

Microsoft has confirmed that a set of certificates used by Windows Update will expire on 17 May 2027 and 19 June 2027. Devices running unsupported versions of Windows, or supported versions that haven't installed the right updates in time, will lose access to Windows Update and stop receiving security updates as a result.

This is not a hack, a breach or an active threat. It's a scheduled technical changeover, the kind of thing that normally happens quietly in the background. Microsoft has flagged it now because some devices will need action before the deadline, and some won't need anything at all.

What this actually means for you

Windows Update checks a certificate to confirm that the updates it's installing are genuinely from Microsoft. The certificates currently doing that job are due to expire. Microsoft has already rolled out replacement certificates to devices running supported, up-to-date versions of Windows, so if your PC updates itself normally, this has likely already happened without you noticing.

The risk is for devices that are behind on updates or running a version of Windows that's no longer supported. If the new certificate never arrives, Windows Update stops working on that device once the old certificate expires, and it won't get any more security patches after that point, for anything.

A few specifics, according to Microsoft's guidance:

• Windows 11 version 25H2 and later: no action needed.
• Windows 11 version 24H2 and Windows Server 2025: need the September 2025 security update or later, installed before 19 June 2027.
• Other supported Windows 11 versions, Windows Server 2022, and Windows 10: need the July 2026 security update or later, installed before 19 June 2027.
• Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016: need the July 2026 security update or later, installed before 17 May 2027.
• Any other version not listed: needs upgrading to a supported version of Windows client or Windows Server.

It's not yet clear from Microsoft's guidance exactly how this applies to Windows 10 Home and Pro editions specifically, given they recently got an extra year of security-only support. If that's the version you're running, it's worth checking Microsoft's own update pages directly rather than guessing.

Businesses that manage updates through Windows Server Update Services (WSUS) are not affected by this particular certificate rotation.

What to do

• Check your Windows version. Go to Settings > System > About and note what you're running.
• Install updates now, not later. If you're on a version with a 2026 deadline, don't leave it until the last minute. Updates can take time to roll out and reboot properly.
• If you're on an older or unsupported version, plan to upgrade to a supported version of Windows before May or June 2027, depending on which deadline applies to you.
• If you're unsure which category your device falls into, check Microsoft's official support pages or ask someone who knows the specifics. The requirements genuinely differ by version, and guessing wrong could mean missing the window.
• If you manage a small business on WSUS, this particular issue doesn't apply to you, though it's still worth confirming your update process is current.

What this does not fix

Installing the right update or certificate does one thing: it keeps Windows Update working so your device can keep receiving security patches. It doesn't make your device secure on its own. You still need to actually install the patches that follow, keep your browser and apps updated, and use sensible passwords.

A VPN doesn't touch any of this. It can hide what you're doing online from your network or ISP, but it has no role in installing Windows updates, patching vulnerabilities, or renewing certificates. If your operating system stops getting security updates, a VPN won't compensate for that. The only real fix for an unsupported or out-of-date Windows device is to update it or replace it.