Windows Update Certificate Rotation: How to Keep Receiving Security Patches

Microsoft is preparing to rotate the digital certificates used by Windows Update to verify the authenticity of its servers, a backend change that will eventually cut off security updates for PCs running outdated versions of the operating system. To maintain connectivity to update services, devices must have specific monthly security patches installed well before the certificates expire in 2027.

The rotation is a standard security measure designed to ensure that the connection between a user’s PC and Microsoft’s update infrastructure remains secure. However, because older versions of Windows do not inherently recognize the new certificates, they require a “bridge” update to bridge the gap. Without these updates, the automatic update path will be broken, leaving devices unable to pull new security definitions or feature improvements.

Deadlines and Requirements

The transition follows two distinct deadlines based on the specific version of Windows or Windows Server in use. According to a Microsoft Community Hub announcement, the certificates are scheduled to expire on May 17, 2027, and June 19, 2027.

For most consumer and enterprise users, the critical milestone is the July 2026 security update. If a PC running Windows 10 or older versions of Windows 11 (prior to version 24H2) does not have the July 2026 patch or a later version installed by June 19, 2027, it will lose access to Windows Update services entirely.

The requirements vary slightly for newer releases and specialized versions:

Windows 11 version 25H2 and later: These versions include the necessary certificates natively; no action is required from the user or IT administrator. Windows 11 version 24H2 and Windows Server 2025: These must have the September 2025 security update (or any later update) installed before the June 19, 2027, deadline. Legacy and LTSC Versions: Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016 face an earlier deadline of May 17, 2027. Devices must have specific bridge updates installed before the 2027 certificate expiration dates.

Impact on Maintenance and Security

For users who regularly install monthly updates, this rotation is expected to be a non-event. Because the required certificates are delivered automatically through the standard cumulative update process, PCs that are kept current will receive the new credentials long before the old ones expire.

The risk is primarily centered on “frozen” systems or devices that have been disconnected from the internet for long periods. If a device misses the deadline and its certificates expire, it will require manual intervention to restore update functionality. Reporting suggests that once the automatic update path is broken, future updates would likely need to be downloaded and installed manually via the Microsoft Update Catalog to re-establish the trust relationship with the update servers.

Organizations using third-party update management tools, such as WSUS or Microsoft Intune, are still subject to these requirements, as the underlying Windows Update agent on the local machine must still be able to verify the packages it receives. Unsupported versions of Windows that no longer receive monthly updates will lose access to the service permanently once the rotation is complete.

The post Windows Update Certificate Rotation: How to Keep Receiving Security Patches appeared first on World Weekly News.