To protect your security, Windows operating system updates are dual-signed using both the SHA-1 and SHA-2 hash algorithms to authenticate that updates come directly from Microsoft and were not tampered with during delivery. Due to weaknesses in the SHA-1 algorithm and to align to industry standards Microsoft will only sign Windows updates using the more secure SHA-2 algorithm exclusively.

Customers running legacy OS versions (Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2) will be required to have SHA-2 code signing support installed on their devices by July 2019.

Any devices without SHA-2 support will not be offered Windows updates after July 2019.

Read more:

Windows 7’s support deadline may expire in July, if you don’t apply this patch

2019 SHA-2 Code Signing Support requirement for Windows and WSUS