Microsoft: Install security updates now to keep Windows patching after 2027 certificate expiry

Microsoft is advising users and businesses to update Windows devices before digital certificates expire in 2027. These certificates verify Windows Update servers, and their expiration will block access to security fixes for unpatched systems.

What happened

Microsoft announced that digital certificates used to verify Windows Update servers will expire in May and June 2027. According to Help Net Security, the specific expiration dates are May 17 and June 19, depending on the Windows version installed on the device. Devices that do not possess replacement certificates will lose connectivity to the Windows Update service entirely. This loss of access means the systems will no longer receive critical security fixes delivered through that channel.

Microsoft is distributing the necessary replacement certificates through a process known as certificate rotation. Andrew Brown of Microsoft stated that keeping devices up to date today is the key to maintaining update access beyond 2027. Most users running a supported Windows version and installing monthly updates should receive the replacement certificates automatically without manual intervention. However, some versions require specific actions from IT administrators to ensure the new certificates are installed correctly.

Supported systems that have fallen behind on updates need to install the required security update to regain access. Microsoft advises users with unsupported versions of Windows to upgrade their operating systems entirely. Windows 11 version 25H2 and later versions require no action from users or administrators. Version 24H2 needs the September 2025 security update or a later release to include the new certificates.

Several other supported versions need the July 2026 update or a later release to maintain connectivity. Supported systems can regain access after the deadline by installing the required update manually. Administrators can download these updates from the Microsoft Update Catalog or distribute them through their existing management tools. Devices receiving updates through Windows Server Update Services, or WSUS, are excluded from this change and are not affected.

Why it matters

The expiration of these certificates creates a hard stop for update connectivity on devices that are not current. Without the replacement certificates, the operating system cannot verify the identity of the Windows Update servers. This security mechanism prevents devices from receiving any further patches, including those addressing high-severity vulnerabilities.

For IT managers, this highlights the operational risk of allowing supported systems to fall behind on patching schedules. While automatic updates cover most users, legacy supported versions require deliberate administrative action. Failure to install the specific updates for versions like 24H2 or older builds will result in isolated devices. These devices will remain vulnerable to new threats that are patched in subsequent monthly updates.

The distinction between supported and unsupported versions is critical for compliance and security planning. Unsupported versions will not receive the certificate rotation updates and must be upgraded to a supported OS. This ensures that the entire fleet maintains a secure connection to Microsoft's update infrastructure. Organizations must audit their environments to identify devices running versions that require manual intervention.

What to watch

• Monitor the release of the September 2025 update for Windows 11 version 24H2.
• Track the July 2026 update release for other supported older versions.
• Verify that WSUS servers are configured to handle the certificate rotation correctly.
• Check device logs to confirm successful installation of the replacement certificates.

What to do and how to stay safe: Microsoft

• Audit your environment to identify all Windows devices running versions older than 25H2.
• Ensure that all supported devices are configured to receive and install monthly security updates automatically.
• Plan for the deployment of the September 2025 update for version 24H2 devices before the certificate expiration.
• Upgrade any devices running unsupported versions of Windows to a currently supported release.

Step-by-step guide: Software Updates Best Practices: Secure Patching Without Downtime

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Windows versions are affected by the certificate expiration?

Windows 11 version 24H2 and several other supported older versions are affected. Windows 11 version 25H2 and later are not affected.

What happens if I do not update my device before 2027?

Devices without replacement certificates will lose access to Windows Update and stop receiving security fixes.

Do devices using Windows Server Update Services need to change anything?

No, devices receiving updates through Windows Server Update Services are excluded from this change.