# Microsoft Sets Deadlines for Critical Windows Update Certificate Rotation in 2027 Unpatched systems will permanently lose access to Microsoft servers following certificate expiration dates. - **Source:** [PCWorld](https://www.pcworld.com) - **Published:** 2026-10-13 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/e1f26544-40ac-4fc7-a345-e5b7bc0d6f4e ## Mandatory Certificate Rotation Schedule Microsoft announced that security certificates establishing trusted connections to Windows Update will expire in mid-2027. Systems lacking replacement certificates will lose the ability to download patches. The expiration affects standard update channels directly connected to Microsoft servers, necessitating proactive patch management across all active client deployments. ## Critical Expiration Milestones Defined The certificate lifecycle ends across two distinct deadlines: May 17, 2027, and June 19, 2027. Legacy enterprise platforms face the earlier cutoff, while standard consumer versions must be patched before June. Without updated cryptographic trust anchors, affected endpoints cannot validate connections to official Microsoft delivery mechanisms. ## WSUS Infrastructure Remains Unaffected Microsoft confirmed that systems sourcing updates internally via Windows Server Update Services are exempt from this specific server handshake change. However, endpoints pulling directly from public Windows Update servers must possess the rotated certificates. Enterprise administrators managing hybrid patching topologies must review standalone client configurations immediately. ## Targeted Timelines for Windows 11 Devices running Windows 11 version 24H2 or Windows Server 2025 require the September 2025 security update or subsequent releases prior to June 19, 2027. Newer versions like 25H2 and 26H2 receive these trust assets automatically through regular July 2026 cumulative maintenance releases. ## Legacy and LTSC Patching Requirements In-support Windows 10 releases and Windows Server 2022 require July 2026 security updates before June 19, 2027. Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Server 2016 must apply July 2026 patches before the stricter May 17, 2027 expiration cut-off point. ## Consequences for Unsupported Systems Endpoints running end-of-life operating systems will fail to receive the certificate rotation updates entirely. Once certificates expire, these systems will be severed from Microsoft distribution networks, preventing manual or automatic patching. Upgrading to actively supported Windows releases is mandatory to maintain future operational baseline security. ## Echoes of Secure Boot Challenges This transition follows recent turbulence surrounding Secure Boot certificate renewals intended to block boot-level rootkits. The impending rotation similarly alters cryptographic trust chains, but targets update distribution directly. Failure to install prerequisites risks permanently stranding devices without a supported mechanism for subsequent software updates. ## Recommended Compliance Action Path System administrators must inventory fleet OS builds and verify installation of baseline patches from late 2025 and mid-2026. Prioritizing updates on LTSC and older supported servers prevents disconnects before the May 2027 deadline, while routine consumer patching handles newer Windows 11 clients effortlessly. ## Sources covering this story - https://www.pcworld.com/article/3259575/your-pc-could-lose-windows-update-access-in-2027-heres-what-to-do.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._