Summary
- Microsoft says update connection certificates expire on 17 May and 19 June 2027.
- Supported, updated systems generally receive replacement certificates automatically.
- Unsupported operating systems face loss of Windows Update access; WSUS delivery is excluded.
Microsoft has warned that some Windows devices could lose their ability to connect to Windows Update when existing service authentication certificates expire in May and June 2027, placing particular pressure on organisations retaining unsupported operating systems.
A Windows message-centre notice published on 8 October 2026 explains that certificates supporting trusted connections to Microsoft’s update service expire on 17 May and 19 June next year. Devices require replacement certificates to continue receiving updates through that service after the relevant date.
Microsoft says it has already delivered the replacements through regular Windows security updates. Most devices running supported Windows releases will require no additional action if they are current. The immediate concern is therefore not a universal loss of Windows Update functionality but devices that have stopped receiving the updates needed to refresh trust.
Unsupported Windows versions will lose Windows Update access as a consequence, according to the notice. Devices using Windows Server Update Services for update delivery are not affected by this specific change. That exception matters for centrally managed environments and should be distinguished from other certificate transitions affecting Windows security.
The relevant deadlines differ by Windows generation. Windows 11 version 25H2 and later require no action under the listed guidance, while some supported Windows 11 and server releases need specified security updates from 2025 or 2026. Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016 are among the branches linked to the earlier 17 May deadline, subject to applicable updates.
The notice also gives administrators a recovery route for supported devices that remain behind after the expiration date: obtain the necessary update through the Microsoft Update Catalog or approved deployment management tools. The key distinction remains support status and availability of a suitable replacement package.
Older Windows images in manufacturing, medical, laboratory or specialist equipment create an update-service dependency tied to lifecycle decisions made years earlier. An application may continue to perform its intended role after mainstream support has ended, while its underlying operating system no longer follows the trust-certificate rotation required by external services.
This is a certificate dependency issue, not proof that attackers have broken Windows Update signatures or that an unpatched device is already compromised. Nor is it identical to the separate Windows Secure Boot certificate changes and future post-quantum code-signing transitions. Each uses different certificates for different trust decisions.
Microsoft’s advice is to identify affected devices, check their Windows versions, compare installed update levels with the required baselines and upgrade unsupported systems where possible. Administrators should account for machines that are seldom online or updated, as those may miss automatic certificate distribution even while their nominal operating system branch remains supported.
The 2027 dates create a practical milestone for fleet discovery and lifecycle planning. A supported and current system should continue updating normally; a legacy device outside support may need a replacement platform or a documented transition route before its update connection expires.
Microsoft’s notice provides distinct update baselines for different supported branches, rather than a single certificate patch appropriate to every Windows installation. The earlier May deadline applies to certain older supported server and long-term-servicing products, whereas other supported clients and servers have until the June expiry. An accurate device inventory therefore needs operating system edition, version and installed security-update level, rather than only a count of devices labelled Windows 10 or Windows 11.
The WSUS exception is limited to the certificate change described in the notice and does not mean that legacy systems are exempt from ordinary patching or support-lifecycle risks. Similarly, a supported computer missing the replacement package has a different recovery route from one running an unsupported release. Those distinctions explain why Microsoft directs administrators to its Update Catalog and established management tools for supported devices that have missed the automatic distribution.
