Expiring Windows Update certificates will cut unsupported devices off from updates in 2027

"As a standard security practice, these certificates have an expiration date. This means that they eventually need to be rotated (that is, replaced by new certificates). A set of these certificates will expire on May 17, 2027 and June 19, 2027," Microsoft said on Thursday ^[1]. The notice describes a certificate rotation. No flaw is involved, and nothing changes for an attacker before May 17, 2027 ^[1].

For Windows 11 25H2 and later, this does not matter. Microsoft lists no action ^[2]. Every other release on the list comes with a required action ^[12]. Running a supported version does not clear a machine by itself. The build has to carry the named update by the named date ^[4][5].

The two dates are 33 days apart: the 14 days left in May after the 17th, plus 19 days of June ^[13]. That month comes off the window for the oldest servers on the list ^[5]. Counting from July 2026, those servers have roughly ten months to take the prerequisite update ^[14].

Windows 11 26H2 shipped last month as a small enablement package for eligible 24H2 and 25H2 systems, in a phased rollout that expands over the next few months ^[10]. A 24H2 machine that takes it moves into the 25H2-and-later group, where Microsoft lists no action ^[15].

BleepingComputer states the WSUS exception in its own words and does not say how WSUS-fed devices handle the rotated certificates ^[9].

Microsoft's advice to administrators is to find every device on an older or unsupported version, keep monthly updates flowing to supported ones, and draw up an upgrade plan before the 2027 dates ^[8]. "And if you do need to act on older device populations, there's still time! Review, update, and plan upgrades for unsupported versions before the May 2027 or June 2027 certificate expiration dates," Microsoft added ^[11].