Microsoft updates certificate policy for Windows

Microsoft is replacing security certificates used by Windows Update, which are valid until May 17 or June 19, 2027, depending on the version of Windows. These certificates are essential for verifying the authenticity of updates delivered by Microsoft's servers.

New certificates included in monthly updates

The new certificates are delivered with the monthly security updates. Once the old certificates expire, Microsoft will no longer distribute updates to PCs that have not installed these new certificates. This ensures that updates are trusted and secure.

Trust connection required for updates

To prove to a Windows PC that its updates come from Microsoft's servers, the operating system uses digital certificates with limited lifespans. Two sets of these certificates will expire in spring 2027, and their replacements are included in the monthly security updates.

Impact on affected devices

Microsoft warned that affected devices will no longer be able to connect to Windows Update and will not receive any type of update after the expiration date. This is particularly an issue for machines running a version of Windows nearing the end of support or that have missed updates for months.

No action needed for newer Windows versions

Microsoft does not require any action on Windows 11 25H2 and newer versions, including the currently being deployed 26H2. For Windows 11 24H2 and Windows Server 2025, installing the September 2025 security update or a more recent one before June 19, 2027, is sufficient.

Specific deadlines for other versions

For other supported versions of Windows 11 and Windows 10, as well as Windows Server 2022, the July 2026 update must be installed before June 19. The deadline is shorter for Windows 10 Enterprise 2019 LTSC and for the 2016 and 2019 editions of Windows Server, which must receive the update before May 17.

WSUS servers not affected

Companies that distribute their updates via their own WSUS server are not affected by the certificate changes. Users can check their installed version by typing "winver" in the Windows search bar and reviewing the update history.

Manual updates available

If a PC does not have the required updates installed, a manual search from the Settings or using the Microsoft Update Catalog can resolve the issue. The Microsoft Update Catalog allows users to download necessary updates manually for affected machines.

Extended support for Windows 10

Microsoft has extended the end of the Extended Security Update (ESU) program to October 12, 2027. Registration for ESU is free in the European Economic Area for a PC associated with a Microsoft account. However, Windows 10 PCs not registered in the ESU program are at higher risk.

Challenges with older systems

According to StatCounter, 26.92 percent of active Windows PCs in France were still running Windows 10 in June. However, the actual proportion of affected PCs is difficult to determine. Older systems without ESU or recent updates will face greater challenges in maintaining security and functionality.

Certificate rotation mechanism

The new certificates are delivered through the monthly updates as part of a planned certificate rotation mechanism. If a PC does not install the update with the replacement certificates before the old ones expire, it will be unable to establish the necessary trust to receive future updates.

Understanding update distribution methods

Windows Update is the standard online service used by most PCs to automatically download updates. WSUS is an internal solution for companies, allowing updates to be approved and redistributed locally. The Microsoft Update Catalog is a resource for manually downloading updates, useful for troubleshooting or offline machines. In all cases, the updates carrying the replacement certificates are essential for maintaining the trust chain.