Unfortunately, the security of the SHA-1 hash algorithm has become less secure over time because of the weaknesses found in the algorithm, increased processor performance, and the advent of cloud computing.

The Secure Hash Algorithm 1 (SHA-1) was developed as an irreversible hashing function and is widely used as a part of code-signing. Please see the 'Product update schedule' section for the SHA-2 only migration timeline. Windows Server Update Services (WSUS) 3.0 SP2 will receive SHA-2 support to securely deliver SHA-2 signed updates. To help prepare you for this change, we released support for SHA-2 signing in starting March 2019 and have made incremental improvements.

Any devices without SHA-2 support will not be able to install Windows updates on or after July 2019. This change was done in phases starting in April 2019 through September 2019 to allow for smooth migration (see the 'Product update schedule' section for more details on the changes).Ĭustomers who run legacy OS versions (Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2) are required to have SHA-2 code signing support installed on their devices to install updates released on or after July 2019.

Because of weaknesses in the SHA-1 algorithm and to align to industry standards, we have changed the signing of Windows updates to use the more secure SHA-2 algorithm exclusively.

The signatures are used to authenticate that the updates come directly from Microsoft and were not tampered with during delivery. To help protect the security of the Windows operating system, updates were previously signed (using both the SHA-1 and SHA-2 hash algorithms).

Kb4474419 and kb4490628