Microsoft warns Windows Update access will fail if certificate rotation is missed
Devices must receive new digital certificates by mid-2027 to maintain access to Windows Update servers and critical security fixes.
Key points
- Microsoft is distributing replacement digital certificates to prevent service interruption.
- Windows Update servers will reject devices lacking valid certificates after May and June 2027.
- Failure to update results in loss of access to security fixes delivered through the service.
Microsoft is advising users and businesses to ensure their Windows devices receive updated digital certificates before existing ones expire in 2027. The company is distributing these replacements through a process known as certificate rotation to maintain connectivity with Windows Update servers.
The current certificates used to verify Windows Update servers will expire on specific dates depending on the Windows version. According to Help Net Security, the expiration dates are May 17 and June 19, 2027. Devices that do not have the replacement certificates installed by these deadlines will lose access to the update service entirely.
Certificate Rotation Mechanics
Microsoft is actively distributing the replacement certificates to devices ahead of the expiration timeline. This distribution process is referred to as certificate rotation. The goal is to ensure that devices have the necessary credentials to authenticate with Windows Update servers after the old certificates become invalid.
The verification process relies on these digital certificates to confirm the identity of the update servers. When a certificate expires, the trust chain is broken. Consequently, the Windows Update client on the device will no longer be able to establish a secure connection to download new updates, including critical security patches.
Impact on Devices and Users
Devices without the replacement certificates will lose access to Windows Update. This loss of access includes the inability to receive security fixes delivered through the service. For businesses and individual users, this means that devices that miss the rotation window will become vulnerable to newly discovered security flaws because they cannot download the corresponding patches.
The impact varies by Windows version, as the expiration dates differ. Some devices will lose access starting May 17, 2027, while others will retain access until June 19, 2027. This staggered timeline requires administrators to track the specific versions running in their environments to ensure timely certificate updates.
What should you do?
Organizations should verify that their Windows devices are successfully communicating with Windows Update servers. IT teams need to monitor for the presence of the new certificates on endpoints. Ensuring that devices are not blocked from receiving updates by local group policies or firewalls is essential for the rotation to succeed.
What to do and how to stay safe: Microsoft
- Verify that Windows Update services are running and not blocked by network security policies.
- Check device logs to confirm successful communication with Microsoft update servers.
- Ensure endpoint management systems are configured to allow automatic certificate updates.
- Monitor for any error codes related to certificate validation or trust chain issues.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When do the Windows Update certificates expire?
The certificates expire on May 17, 2027, or June 19, 2027, depending on the Windows version.
What happens if a device does not get the new certificate?
The device will lose access to Windows Update, including security fixes delivered through the service.
How is Microsoft distributing the new certificates?
Microsoft is distributing the replacements through a process known as certificate rotation.
