Windows Update Certificates Expire in 2027: What to Check
Microsoft's new reminder is about staying connected to Windows Update, not an immediate shutdown. Current supported PCs generally need no special action; neglected and unsupported installations need attention.
The short version
What you need to know
- Windows Update connection certificates expire on 17 May and 19 June 2027, depending on the Windows version.
- Microsoft says most supported devices that are current with monthly updates need no action; Windows 11 25H2 and later require none for this rotation.
- Unsupported Windows needs an upgrade plan. A VPN cannot install replacement certificates or restore operating-system support.
What Microsoft announced
In an 8 October notice, Microsoft said certificates used to establish trusted connections to Windows Update will expire on 17 May and 19 June 2027. Devices need their replacements to keep receiving updates after the date applicable to their version.
This is advance maintenance guidance, not evidence that your PC is infected or will stop starting next year. Microsoft says devices without the replacement certificates will lose access to Windows Update. It also says most supported installations that are current with monthly updates need no additional action.
Which installations need attention
Microsoft lists Windows 11 version 25H2 and later as requiring no action for this certificate rotation. Windows 11 version 24H2 and Windows Server 2025 need the September 2025 security update or later before 19 June 2027.
Other in-support Windows 11 versions, Windows Server 2022 and in-support Windows 10 versions need the July 2026 security update or later before 19 June 2027. Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016 need the July 2026 security update or later before 17 May 2027.
For other Windows versions, Microsoft advises upgrading to a supported client or server version. These minimum update levels address the certificates; they are not a recommendation to stop installing newer patches or a promise that an edition remains supported until those deadlines. Microsoft explicitly excludes devices receiving updates from Windows Server Update Services, or WSUS, from this change.
What to do on a home or work PC
Check your Windows version and edition in Settings, then use the built-in Windows Update page to check for available updates. Install applicable updates and complete required restarts. Do not download a certificate fixer advertised in an email or pop-up.
If Windows reports that your version is unsupported, plan a supported upgrade rather than waiting for the certificate deadline. Back up important files before a major operating-system change. A managed work PC should go through your IT team, which can check its update source and applicable policy.
For an older spare laptop, the useful check is whether it is both supported and actually receiving updates. A device that still boots and browses is not necessarily receiving security fixes.
A VPN is not a substitute for patching
A VPN changes how supported network traffic reaches the internet. It does not repair Windows Update trust certificates, extend Microsoft's support lifecycle or patch flaws in Windows. Keep operating-system maintenance separate from VPN settings.
Our privacy guide explains the separate limits of what a VPN hides.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.