Will Your PC Lose Windows Update in 2027? The May 17 and June 19 Certificate Deadlines, and How to Check Yours

Most Windows deadlines are about security patches ending. This one is different.

On October 8, 2026, Microsoft said the certificates Windows uses to trust its own update servers will expire in 2027. A PC without the replacement certificates won’t just miss patches. It won’t be able to connect to Windows Update at all, not even to download the update that would fix it.

The good news: if your PC has been updating normally, it almost certainly has the new certificates already. Here’s how to make sure, and what to do if it doesn’t.

Jump to a Section

• What is the Windows Update certificate rotation in 2027?
• Will my PC lose Windows Update in 2027?
• How do I check if my PC is ready?
• What about Windows 10 PCs that never joined ESU?
• Is this the same as the Secure Boot certificate expiry?
• Fixing a PC That Is Months Behind
• Tips
• Warnings
• FAQ
• Sources

What is the Windows Update certificate rotation in 2027?

The Windows Update certificate rotation is Microsoft’s replacement of the certificates Windows devices use to confirm they are talking to genuine Windows Update servers, and according to Microsoft’s Windows message center post of October 8, 2026, the current set expires on May 17, 2027 and June 19, 2027.

Certificates expire on purpose. It’s standard security practice. Microsoft has been shipping the new ones inside regular monthly updates, so most PCs picked them up without anyone noticing.

The Windows IT Pro Blog post is blunt about the risk: if unaddressed, affected devices “will stop connecting and receiving all types of updates from Windows Update.” That includes feature updates, drivers delivered through Windows Update, and Defender definitions that come that way.

One carve-out: the change doesn’t apply to devices that get updates from Windows Server Update Services (WSUS). That’s a business setup. Home PCs use Windows Update directly.

Will my PC lose Windows Update in 2027?

A Windows PC loses Windows Update access after mid-2027 only if it lacks the replacement certificates, and Microsoft says devices on Windows 11 version 25H2 or later need no action, while older supported versions need a specific minimum security update installed before the expiry date.

Source: Microsoft, “Prepare for Windows Update certificate rotation in 2027,” Windows IT Pro Blog and Windows message center, October 8, 2026. Server editions omitted.

When I compared this table with Microsoft’s lifecycle dates, I noticed one wrinkle for home users. Windows 11 24H2 Home and Pro reach end of servicing on October 13, 2026. A 24H2 PC that’s current has the certificates, but it stops getting security fixes. Moving to 25H2 or 26H2 solves both problems at once. We covered why that update sometimes doesn’t appear in our 24H2 end-of-support guide.

How do I check if my PC is ready?

To check whether a Windows PC is ready for the 2027 Windows Update certificate expiry, confirm the Windows version with winver and confirm in Settings that a security update from the required month or later is installed, since Microsoft ties readiness to version plus update level rather than to a separate certificate setting.

Method 1: Find your Windows version

1. Press Windows key + R, type winver, and press Enter.
2. Read the version line. It says something like “Version 25H2” for Windows 11 or “Version 22H2” for Windows 10.
3. Match it to the table above. If it’s 25H2 or 26H2, you’re done.

Microsoft’s Find information about your Windows device page shows the same steps with screenshots.

Method 2: Check your last installed update

1. Open Settings, then Windows Update (on Windows 10: Update & Security, then Windows Update).
2. Click Update history.
3. Look under Quality Updates. Each entry is named with a year and month, such as “2026-09 Cumulative Update.”
4. Compare the newest month to your row in the table. 24H2 needs 2025-09 or later. Windows 10 needs 2026-07 or later.

Honestly, this takes under a minute. If the newest cumulative update is from this autumn, you’re fine.

What about Windows 10 PCs that never joined ESU?

A Windows 10 PC that never enrolled in Extended Security Updates stopped receiving security updates after October 14, 2025, so it does not have the July 2026 update Microsoft lists as the minimum, and it will lose Windows Update access after June 19, 2027 unless it is enrolled and updated first.

This is where the dates collide. Consumer ESU for Windows 10 now runs to October 12, 2027, as we explained in our Windows 10 ESU guide. But the certificate deadline lands almost four months earlier.

I found that Microsoft doesn’t spell out what happens to an unenrolled PC that tries to join ESU after June 19, 2027. Our reading: enrollment and the catch-up updates both run through Windows Update, so waiting past June is a gamble you don’t need to take.

If you’re keeping a Windows 10 PC through 2027, this is the practical checklist:

1. Enroll in ESU now from Settings, Update & Security, Windows Update. Look for the enroll link near the top. Microsoft’s Windows 10 ESU page lists the free and paid options.
2. Install every pending update until Windows Update says you’re up to date.
3. Recheck Update history for a 2026-07 or later cumulative update.

Is this the same as the Secure Boot certificate expiry?

No, the 2027 Windows Update certificate rotation is separate from the Secure Boot certificate expiry, which Microsoft documents in support article KB5062710 and which concerns certificates stored in PC firmware that verify software at startup rather than the connection to Windows Update.

The two get mixed up constantly because both involve “Microsoft certificates expiring.” They affect different things. Secure Boot certificates live in your PC’s firmware and check what loads before Windows starts. The Windows Update certificates protect the link between your PC and Microsoft’s update servers.

The fix overlaps, though. Both rely on keeping Windows current. Microsoft’s Secure Boot certificate article covers that one if your PC maker has sent you a firmware notice.

Fixing a PC That Is Months Behind

Most people skip this step and regret it: a PC that sits in a drawer for a year can quietly fall off the cliff.

• Turn it on and plug it in. Leave it connected to Wi-Fi for an hour and let Windows Update run. Restart when asked, then check again. Repeat until it says you’re up to date.
• If Windows Update fails, download the needed cumulative update manually from the Microsoft Update Catalog. Microsoft names the Catalog as the route for devices that can’t update normally. Search for your version, such as “Windows 11 24H2 cumulative,” and pick the newest one for your processor type (x64 or ARM64).
• If the PC runs an unsupported version like Windows 11 23H2 Home, upgrade it now. After mid-2027 Microsoft says it “won’t receive any updates.”
• Old spare laptops you only use offline can be ignored. But don’t put one back online in 2028 expecting it to catch up.

Expect this to bite in two places: a parent’s rarely used laptop, and a gaming PC with updates paused for months. Check those first.

Tips

• Set a calendar reminder for March 2027 to recheck any PC you don’t use daily.
• Leave “Pause updates” off on family PCs. A five-week pause is fine; a year of pauses isn’t.
• On Windows 11, turning on “Get the latest updates as soon as they’re available” gets you to 26H2 sooner, which needs no action at all.
• Keep a note of each household PC’s version. It makes the next deadline a two-minute job.

Warnings

• Don’t download “certificate fix” tools or .reg files from forums. Microsoft delivers the new certificates through normal updates only.
• Don’t trust a “Your PC is up to date” message on a PC that hasn’t been online for months. Click Check for updates and wait.
• Calls or pop-ups claiming your “Windows certificate has expired” and asking you to phone a number are tech-support scams.
• Microsoft’s guidance could be revised before 2027. Check the Windows message center again in spring.

FAQ

Will my PC stop working after the Windows Update certificates expire?

No. Windows keeps running normally. A PC without the new certificates simply cannot connect to Windows Update after May 17 or June 19, 2027, so it stops receiving security fixes, drivers, and feature updates from Microsoft.

Does Windows 11 26H2 need anything for the 2027 certificate change?

No. Microsoft lists Windows 11 version 25H2 and later as requiring no action, and 26H2 is newer than 25H2. Keep installing monthly updates as usual.

Can I install the certificates without Windows Update?

Microsoft says the certificates come inside the listed security updates, which you can download manually from the Microsoft Update Catalog if Windows Update fails. There is no separate certificate download for home users.

Sources

• Microsoft Windows IT Pro Blog — Prepare for Windows Update certificate rotation in 2027
• Microsoft Learn — Windows message center (October 8, 2026 entry)
• Microsoft Learn — Supported versions of Windows client

Fact-checked against Microsoft’s Windows IT Pro Blog, Windows message center, and Windows lifecycle pages as of October 12, 2026. Deadlines apply to devices using Windows Update directly, not WSUS.