Hi Marcin_Kolodziejczak​, Hyper-V host updates does not change the existing VMs that did not already have the new certificates.   All new Hyper-V VMs created have the new certificates pre-installed.  If you have long running VMs, certificates need to be deployed.  Microsoft will be updating the VM devices as part of high confidence based roll out in the future update. You can also apply the certificates to firmware by configuring AvailableUpdates registry value to 0x5944 after updating VM device to latest available windows patches.