If you use Windows Update, the latest SHA-2 update will be offered to you automatically. For more information about SHA-2 updates, see 2019 SHA-2 Code Signing Support requirement for Windows and WSUS. For Windows 7 SP1 and Windows Server 2008 R2 SP1, you must have the servicing stack update (SSU) (KB4490628) that is dated March 12, 2019.