This article describes an update that enables urgent updates for the Windows Root Certificate Programin Windows 8.1, Windows RT 8.1, Windows Server 2012 R2, Windows 8, Windows RT, Windows Server 2012, Windows 7, and Windows Server 2008 R2. Before you apply this update, see more about this updateand check out the prerequisites in this article.

This software update introduces a new tool that administrators can use to view the set of trusted root certificates in the Microsoft Root Certificate Program. This tool is for administrators who manage the set of trusted root certificates for an enterprise environment.

Describes an update for Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2. This update adds the public key or signature hash of known untrusted certificates to CTL.

By default, root certificates are installed automatically if the computer is connected to the Internet. If the "automatic root certificates update" setting is disabled or the computer is offline, you must install this root certificate into the certificate store of "Local Computer" under "Trusted Root Certification Authorities".

Important:Secure Boot certificates used by most Windows devices have started expiring in June 2026. This might affect the ability of certain personal and business devices to boot securely if not updated in time. To avoid disruption, we recommend reviewing the guidance and taking action to update certificates in advance. For details and preparation steps, see Windows Secure Boot certificate ...

These original certificates are nearing their expiration date, and your device is affected if it has any of the listed certificate versions. To continue running Windows and receiving regular updates for your Secure Boot configuration, you will need to update these certificates.

Microsoft's Secure Boot certificates, originally issued in 2011, are approaching expiration in 2026. Updated 2023 certificates are being delivered automatically through Windows Update to consumer devices and some business devices. The Windows Security app now shows whether devices have received these updates, their current status, and whether any action is needed.

讨论 Windows 8.1、Windows RT 8.1、Windows Server 2012 R2、Windows 8、Windows RT、Windows Server 2012、Windows 7 和 中的 Windows 根证书计划更新的更新Windows Server 2008 R2。

As described in Microsoft to use SHA-2 exclusively starting May 9, 2021, beginning May 9, 2021 at 4:00 PM Pacific Time, all major Microsoft processes and services—including TLS certificates, code signing and file hashing—will use the SHA-2 algorithm exclusively.

To protect your environment, complete the following steps for certificate-based authentication: Update all servers that run Active Directory Certificate Services and Windows domain controllers that service certificate-based authentication with the May 10, 202,2 update (see Compatibility mode).