How to fix Windows update error 0x800B010F?

Error 0x800B010F means that Windows Update reached a server whose security certificate is made out to a different name than the one Windows asked for, so Windows refuses to trust it. The update itself is fine. Something on the way redirects the connection: turn off any VPN or proxy first, then check the HTTPS scanning of your security app.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What Windows update error 0x800B010F means

Microsoft's list of security and setup error codes names 0x800B010F CERT_E_CN_NO_MATCH and describes it in one line: "The certificate's CN name does not match the passed value." CN is the common name, the server name written inside a security certificate.

Windows Update talks to Microsoft's servers over encrypted connections. Microsoft lists *.update.microsoft.com among the addresses that use TLS 1.2. Before Windows trusts the answer, it compares the name it asked for with the name on the certificate it received. When the two differ, Windows stops the connection and shows 0x800B010F. That is a safety check working as it should, not a broken Windows.

Why Windows update error 0x800B010F appears

A name mismatch means the request did not reach the server Windows expected, or reached it through something that put its own certificate in between. On a home PC the reasons are, from the most likely to the least likely:

How to fix Windows update error 0x800B010F

Fixes 1 to 4 remove what redirects the connection, and solve most home cases. Fix 5 is for a PC that once belonged to a company or school. Fixes 6 and 7 clear a stuck update session or get one update past the problem by hand.

Fix 1. Disconnect the VPN, turn off a manual proxy and check for updates again

5 minutesNo riskEveryone, first. A VPN or proxy is the most common reason the update request lands on another server.

A VPN or proxy can hand Windows a certificate that belongs to its own server. With both off, the request goes straight to Microsoft, and the name on the certificate matches again.

1. Disconnect your VPN and close any proxy, ad blocking or privacy app that routes your traffic.
2. Open Settings > Network & internet > Proxy. On Windows 10 open Settings > Network & Internet > Proxy.
3. Under Manual proxy setup, check whether Use a proxy server is on. If you did not set it on purpose, turn it off.
4. Restart the PC.
5. Open Settings > Windows Update and select Check for updates.
6. If it fails again, connect once to another network, for example your phone's hotspot, and check for updates there.

Fix 2. Turn off HTTPS scanning in your security app or parental filter for Windows Update

5 minutesLow riskA third-party antivirus, internet security suite, parental control or ad filter is installed.

To read encrypted traffic, such a filter puts its own certificate between the PC and the server. Windows Update checks the server name strictly, so it can refuse the filter's certificate with 0x800B010F even when browsers accept it.

1. Open your security app or filter and look in its web, network or privacy settings.
2. Find the option with a name such as HTTPS scanning, SSL scanning, Scan encrypted connections or Web shield.
3. If the app lets you exclude addresses, add Windows Update there instead of turning the whole option off.
4. If there is no exclusion list, pause the protection for one test: Turn off Microsoft Defender protection for a moment
5. Select Check for updates in Settings > Windows Update.
6. Turn the protection back on right after the test.

Fix 3. Remove Microsoft update entries from the hosts file

10 minutesLow riskYou once used a privacy, anti-telemetry or update blocking tool, or the error came back after such a tool ran.

A line in the hosts file can send a Microsoft address to another IP address. The server there cannot show a certificate with Microsoft's name, so Windows Update stops with a name mismatch.

1. Press Win + S, type notepad, right-click Notepad and select Run as administrator.
2. Select File > Open and paste C:\Windows\System32\drivers\etc\hosts in the file name box. Select Open.
3. Select File > Save as and save a copy named hosts-backup.txt in Documents, then open the original hosts file again the same way.
4. Look for lines that contain microsoft.com, windowsupdate.com or update.microsoft.
5. Put a # at the start of each such line, so Windows ignores it.
6. Select File > Save, then restart the PC and select Check for updates.

C:\Windows\System32\drivers\etc\hosts

Fix 4. Reset the system proxy with netsh winhttp and flush the DNS cache

10 minutesLow riskThe error stays with the VPN off and a clean hosts file, or a VPN or proxy program was installed before.

Microsoft notes that Windows Update connects through WinHTTP, the system level proxy, which is set apart from the proxy you see in Settings. A proxy left there by an old program, or a stale DNS answer, keeps sending the request to the wrong server.

1. Press Win + S, type cmd, right-click Command Prompt and select Run as administrator.
2. Type netsh winhttp show proxy and press Enter.
3. If it names a proxy server and you do not use one on purpose, type netsh winhttp reset proxy and press Enter.
4. If your network really needs a proxy and your browser works through it, type netsh winhttp import proxy source=ie instead.
5. Type ipconfig /flushdns and press Enter.
6. Restart the PC and select Check for updates.

netsh winhttp show proxy
netsh winhttp reset proxy
ipconfig /flushdns

If the error stays and you also have trouble with websites, a full network reset clears Winsock and TCP/IP as well: Reset the network and flush DNS

Fix 5. Check whether the PC is set to a WSUS server and remove an old policy

10 minutesRead the warningA used or former work or school PC, or a PC where a tool changed the update settings.

When the policy gives a WSUS address over HTTPS, the server's certificate must carry exactly that name. An address typed as an IP or a short name, or a server that was renamed, fails the name check on every scan.

1. Open Command Prompt as administrator, as in Fix 4.
2. Type reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /s and press Enter.
3. If Windows says it was unable to find the key, there is no such policy. Go to Fix 6.
4. If the output shows UseWUServer set to 0x1 and an https:// address, the PC is set to use a WSUS server.
5. On a PC that a company or school still manages, stop here and send that address and the code to your IT team.
6. On your own PC with a leftover setting, back up the key first: Back up the registry before editing it
7. Then type reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /f and press Enter.
8. Restart the PC and select Check for updates.

Fix 6. Reset the Windows Update components

10 minutesLow riskNothing on the connection path was found, and the error stays after a restart.

The reset stops the update services, including Cryptographic Services that runs the certificate checks, and renames the SoftwareDistribution and catroot2 folders. Windows Update then starts a new session instead of repeating the failed one.

1. Open Command Prompt as administrator. Type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Stop the update services. Type the commands below and press Enter after each one. If Windows says that other services depend on Cryptographic Services, it stops them too. A message that a service is not started is fine.

   net stop wuauserv
   net stop bits
   net stop cryptsvc

3. Delete the download queue files. This clears the list of downloads that the Background Intelligent Transfer Service keeps. If Windows says it cannot find the files, continue.

   del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

4. Rename the update cache folders. Renaming keeps a copy in case you need it; Windows creates new, empty folders when the services start again. If you get Access is denied, a service is still running: repeat the previous step.

   ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
   ren %systemroot%\System32\catroot2 catroot2.old

5. Start the services again. Type the commands below and press Enter after each one. The requested service has already been started is fine: Windows started it on its own.

   net start cryptsvc
   net start bits
   net start wuauserv

6. Restart and check for updates. Restart the PC. Then select Start > Settings > Windows Update > Check for updates. The first check can take longer than usual because everything is downloaded again.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Reset Windows Update components

Fix 7. Install the update by hand from the Microsoft Update Catalog

10 minutesLow riskOnly one update keeps failing, or you are on a network you cannot change.

The catalog file comes through your browser, and the installer then works from the file on your disk. The connection check of Windows Update is not part of that path.

1. Check your Windows version. Press Windows key + R, type winver and press Enter. Note the version (for example 25H2) and the OS build.
2. Find the KB number. Open Settings > Windows Update. A failed or pending update is listed with its KB number; earlier ones are under Update history.
3. Check the processor type. Open Settings > System > About and look at System type: an x64-based PC needs the x64 file, an ARM-based PC (for example Snapdragon) needs the arm64 file.
4. Search the catalog. Open the Microsoft Update Catalog at catalog.update.microsoft.com in your browser, type the KB number (for example KB5124010) in the search box and press Enter.
5. Pick the right row. Find the row whose title names your Windows version and your processor type (x64-based or arm64-based) and select Download on that row.
6. Download every file listed. A window lists one or more .msu links. Download all of them into one empty folder, for example C:\packages. On Windows 11 24H2 and later the list can include earlier checkpoint updates that the new one needs.
7. Install a single file. If there is only one file, double-click it and confirm the installation in the Windows Update Standalone Installer.

These steps were written for Windows 11 24H2 and later; Windows 10 22H2. The full page with the other versions and what each result means: Install an update from the Microsoft Update Catalog

If the error 0x800B010F is still there

When none of the fixes helped, the log shows which server address Windows Update asked for when the name check failed. That address tells you whether the problem is on your PC, on your network or on a company server.

1. Open PowerShell as administrator, type Get-WindowsUpdateLog and press Enter. It writes WindowsUpdate.log to your desktop.
2. Open the file and search for 800B010F.
3. Read the server address on the lines around it. A Microsoft address means something on your network changed the answer. A company address, often with port 8531, means a WSUS server.

How to keep error 0x800B010F from coming back

If you also see 0x80244017 on the same PC, the same VPN, proxy or WSUS policy is often behind both: How to fix Windows update error 0x80244017.

Frequently asked questions

What does error code 0x800B010F mean when trying to update Windows?

It means that the certificate of the server Windows Update reached carries a different name than the server Windows asked for. Microsoft names the code CERT_E_CN_NO_MATCH and describes it as: the certificate's CN name does not match the passed value. Windows treats that as a possible fake server and stops the connection. The update is not damaged. A VPN, a proxy, HTTPS scanning in a security app, a hosts file entry or a WSUS address is redirecting the request, and Fix 1 to Fix 5 remove those one by one.

What is Windows Update error 800B0100 (WindowsUpdate_800B0100)?

It is a different code. Microsoft names 0x800B0100 TRUST_E_NOSIGNATURE: no signature was present in the subject. Windows Update found a downloaded file without a valid digital signature, which usually means a damaged or incomplete download, not a redirected connection. Reset the Windows Update components as in Fix 6, so the files are downloaded again, then repair system files: Run DISM and SFC to repair Windows system files. The German message Fehler 800B0100 and the Spanish codigo 800B0100 are the same error. Many reports of it come from Windows 7, which Microsoft no longer supports.

What does Windows Update error 800B0001 mean?

Microsoft names 0x800B0001 TRUST_E_PROVIDER_UNKNOWN: unknown trust provider. Windows could not find the component that should check the signature of an update. On old Windows versions it was linked to an outdated update agent. On Windows 11 and Windows 10, reset the update components as in Fix 6, which also restarts Cryptographic Services, and then run the system file check: Run DISM and SFC to repair Windows system files. If it stays, an in-place repair that keeps your files replaces the damaged parts.

What is error 0x800B010A on Windows 7 or Windows 10?

Microsoft names 0x800B010A CERT_E_CHAINING: a certificate chain could not be built to a trusted root authority. Windows could not link the server's certificate to a root certificate it trusts. On Windows 10 and 11, check the date and time first, because a wrong clock breaks the chain check: How to fix the date and time in Windows. Then try Fix 1 and Fix 2 on this page, since HTTPS scanning can cause it too. On Windows 7, the root certificates are often too old, and Microsoft ended Windows 7 support in January 2020, so updates may no longer install at all.

Is the Windows Update server down when I see 0x800B010F?

Almost never. An outage on Microsoft's side gives connection or timeout errors, not a certificate name mismatch. The Microsoft service status page that many guides link to covers Microsoft 365 services such as Outlook.com and OneDrive, not Windows Update. Known Windows Update problems are listed on Microsoft's Windows release health pages. If those show no issue with your version, the cause is on your PC or network, so start with Fix 1.

Why do I get 0x800B010F in the Mail app, the Microsoft Store or a VPN?

Because the code belongs to Windows, not to Windows Update. Any program that uses the Windows certificate checks can show it when a server's certificate carries the wrong name. Users report it in the Mail app when a mail account needs fixing, and with VPN connections where the server name typed in the VPN profile differs from the name on the server's certificate. For a VPN, use the exact server name your provider gives. For the Store, try Fix 1 and Fix 2, then reset the Store: Reset the Microsoft Store.

Should I turn off my antivirus to fix 0x800B010F?

No, not for good. Microsoft Defender does not cause this error. A third-party suite can cause it only when it scans encrypted connections. In that case turn off only its HTTPS scanning or add Windows Update to its exclusions, as in Fix 2. Pausing the whole suite is allowed for one test, and you turn it back on right after. Leaving the PC without protection to get an update is a bad trade.

Is error 0x800B010F a sign of malware?

Usually not. The common causes are a VPN, a proxy or a security filter. But if the hosts file holds Microsoft addresses you never added, or netsh winhttp show proxy lists a proxy you never set, treat it as suspicious. Undo the change as in Fix 3 or Fix 4 and run a full scan with Microsoft Defender. Some unwanted programs redirect web traffic, and Windows Update is often the first thing to notice because it checks certificate names strictly.

Does the Media Creation Tool fix 0x800B010F?

It can update Windows past the error, because Windows 11 Setup downloads the full system and reinstalls Windows over itself while it keeps your files and apps. It does not remove the cause. If a VPN, filter or hosts entry redirects Windows Update, the next monthly update fails again with the same code. Use the fixes on this page first, and keep the in-place repair for a PC where nothing on the connection path was found.

Does Windows 10 still get the updates that fail with 0x800B010F?

Windows 10 left support on 14 October 2025. Windows 10 22H2 still gets security updates only through Extended Security Updates, and Microsoft Defender still gets its definition updates. The fixes on this page work the same on Windows 10 and Windows 11, because the cause is the connection, not the version. If your PC can run Windows 11, moving to it is the long term answer.