Last updated: October 10, 2026
The quick answer
The security certificates that let Windows PCs talk to Windows Update expire on May 17 and June 19, 2027, and Microsoft says devices without the replacement certificates will lose access to Windows Update after those dates. If your PC runs a supported version of Windows and installs monthly updates, you are almost certainly already covered; PCs on unsupported versions need to upgrade.
What happened
On October 8, 2026, Microsoft posted a notice in its Windows release health message center titled “Prepare for Windows Update certificate rotation in 2027.” Certificates are the digital credentials a computer uses to confirm it is connecting to the real Windows Update service and not an impostor. Like website certificates, they have expiration dates, and Microsoft has to swap in new ones before the old ones run out.
Microsoft says the replacement certificates have already been delivered to supported systems through regular monthly updates. The catch is that a PC has to have installed one of those updates before the deadline. A device that never receives the new certificates won’t be able to establish a trusted connection to Windows Update once the old ones expire, which means no more security fixes, driver updates or feature updates through that channel. BleepingComputer, which reported the notice on October 9, highlighted that unsupported Windows versions will be cut off as a result.
What changes for you
For most home users, nothing visible changes. If Windows Update has been installing updates normally over the past few months, the new certificates are probably already on your PC. The people who need to pay attention are those who have paused updates for a long time, run older Windows versions, or keep an old PC around that rarely goes online.
Here is what Microsoft says each version needs:
| Windows version | What you need | Deadline |
|---|---|---|
| Windows 11, version 25H2 or later (including 26H2) | No action required | None |
| Windows 11, version 24H2, and Windows Server 2025 | September 2025 security update or later | June 19, 2027 |
| Other supported Windows 11 versions, supported Windows 10 versions, and Windows Server 2022 | July 2026 security update or later | June 19, 2027 |
| Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016 | July 2026 security update or later | May 17, 2027 |
| Any other Windows version | Upgrade to a supported version | Before the certificates expire |
Microsoft also notes that the change does not apply to devices that get updates from Windows Server Update Services (WSUS), a tool companies use to manage updates internally. If your work laptop is managed by an IT department, they will handle this.
How to check that your PC is ready
- Find your Windows version. Press the Windows key, type winver and press Enter. The window shows your edition and version number, such as 24H2 or 25H2. You can also go to Settings > System > About.
- Check your update history. Open Settings > Windows Update > Update history. Look for a monthly security update (often called a cumulative update) dated July 2026 or later, or September 2025 or later if you’re on 24H2.
- Install anything pending. In Settings > Windows Update, select Check for updates and install what’s offered. If updates are paused, resume them.
- Turn on spare PCs. An old laptop that sits in a drawer won’t receive certificates while it’s off. Power it on, connect it to the internet and let it update well before May 2027.
- Plan an upgrade if your version is unsupported. If your PC runs a Windows version that no longer gets security updates, Microsoft’s guidance is to move to a supported version. If the hardware can’t run Windows 11, it may be time to budget for a replacement.
New to the latest release? Our guide to the Windows 11 2026 Update (26H2) explains what’s new and how to get it, and our roundup of Microsoft’s October 2026 deadlines covers the end of support for version 24H2.
Who it affects and who it doesn’t
Not affected in practice: anyone on Windows 11 version 25H2 or newer, and anyone on a supported version who keeps automatic updates turned on. Company devices managed through WSUS are outside the scope of this notice.
Worth checking: Windows 10 users. Microsoft’s table refers to “in-support” versions of Windows 10, so a Windows 10 PC that is still receiving security updates, for example through Extended Security Updates, and has installed the July 2026 update or later should be covered. A Windows 10 PC that stopped getting updates falls into the “other Windows versions” group, which Microsoft says needs an upgrade.
Most at risk: PCs with updates paused indefinitely, offline machines, and anything running a Windows release that has already reached end of support.
Keeping devices patched matters on every platform. Today we also covered a new spyware variant that targets unpatched iPhones.
FAQ
Will my PC stop working after June 2027?
No. Microsoft says devices without the new certificates will lose access to Windows Update. The PC will still turn on and run apps, but it will stop receiving updates, which leaves it more exposed to security threats over time.
Do I need to download or install certificates manually?
No. The replacement certificates come with Microsoft’s regular monthly updates. Installing the update listed for your version is enough; there is no separate download.
What if I find a message or email telling me to install a “certificate update” urgently?
Treat it as suspicious. Microsoft delivers these certificates through Windows Update itself. Don’t download certificate files or “fixes” from links in emails, pop-ups or search ads.
Leave a Reply