Stand Alone security updates KB4474419 and KB4490628 released to introduce SHA-2 code sign support. We will continue to update this page as needed. Please note that the following timeline is subject to change. Microsoft is targeting the following schedule to offer SHA-2 support. Starting in early 2019, the migration process to SHA-2 support began in stages, and support will be delivered in standalone updates. For more information about of the deprecation of SHA-1, see Hash and Signature Algorithms. Stronger alternatives such as the Secure Hash Algorithm 2 (SHA-2) are now strongly preferred as they do not experience the same issues. Unfortunately, the security of the SHA-1 hash algorithm has become less secure over time because of the weaknesses found in the algorithm, increased processor performance, and the advent of cloud computing. The Secure Hash Algorithm 1 (SHA-1) was developed as an irreversible hashing function and is widely used as a part of code-signing. Please see the 'Product update schedule' section for the SHA-2 only migration timeline. Windows Server Update Services (WSUS) 3.0 SP2 will receive SHA-2 support to securely deliver SHA-2 signed updates. To help prepare you for this change, we released support for SHA-2 signing in starting March 2019 and have made incremental improvements.

Any devices without SHA-2 support will not be able to install Windows updates on or after July 2019.

This change was done in phases starting in April 2019 through September 2019 to allow for smooth migration (see the 'Product update schedule' section for more details on the changes).Ĭustomers who run legacy OS versions (Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2) are required to have SHA-2 code signing support installed on their devices to install updates released on or after July 2019.

Because of weaknesses in the SHA-1 algorithm and to align to industry standards, we have changed the signing of Windows updates to use the more secure SHA-2 algorithm exclusively. The signatures are used to authenticate that the updates come directly from Microsoft and were not tampered with during delivery. To help protect the security of the Windows operating system, updates were previously signed (using both the SHA-1 and SHA-2 hash algorithms).

Kb4474419 and kb4490628