Why does my certificate show as revoked after Windows Server 2019 updates?

First, check the exact error and which certificate in the chain it refers to. A revoked leaf certificate, a revoked intermediate, and a failure to reach a revocation service need different fixes.

Compare the certificate serial number and chain on the affected server with a working server. Then inspect the CRL or OCSP response used for the certificate reported as revoked, including its issue and next update times. A renewed certificate may have a different serial number even if it covers the same sites.

Check the Windows trust lists as well as the issuer's revocation data. The disallowed certificate trust list is not the same thing as a CA's CRL. Compare trust list versions and certificate chains between the patched and unpatched servers to see whether a trust change explains the difference.

The timing makes the update worth investigating, but it doesn't prove the update revoked the certificate. Save the exact error, chain details, update list and relevant event logs before removing anything. If you can reproduce the result after uninstalling and reinstalling the update in a safe test environment, that gives you much stronger evidence.

Certificate lifetime rules came up as a possible explanation, but don't assume a certificate valid beyond 200 days is being treated as revoked. That would need evidence from the actual error and applicable policy. The issuer can confirm the status of the leaf certificate and help interpret its revocation response.