Microsoft is preparing customers for its next certificate change, with Windows Update among the components affected, heise online reported on 12 October 2026. Certificate rotations are easy to ignore until they are not: the certificates involved are the ones that let a machine prove that an update really came from Microsoft, and that the software it boots really is the software it is supposed to be.
The reason these events are uncommon but consequential is the lifespan of the certificates themselves. Rather than issuing a fresh certificate every year, Microsoft embeds long-lived certificates in firmware and operating system images, so that devices that are offline for months can still validate what they receive. The cost of that design is a cliff: when an embedded certificate finally expires, every device that has not received the replacement — through a firmware update, an operating system update, or a key delivered to the Secure Boot database — can be left unable to verify new software.
That is why Microsoft's guidance tends to arrive well in advance, and why the practical work falls on IT administrators rather than end users. The standard checklist is unglamorous: know which certificate expires when, confirm that devices check in and receive updates, confirm that firmware and operating system versions are new enough to carry the replacement, and keep a pilot ring to catch the machines that fail. Devices that are switched off, imaged from old media or frozen on unsupported firmware are the ones that surface as a problem after the deadline, not before.
For ordinary users with a supported, regularly updated PC, the practical advice is unchanged: install updates, and do not defer restarts indefinitely. For organisations, the heise report is a reminder to put the date in the calendar now — the work is trivial while there is time and expensive afterwards.
