0x80072f8f is ERROR_WINHTTP_SECURE_FAILURE: the secure (TLS) connection to Microsoft’s servers could not be established, so the update client refused to proceed. It appears when checking for updates, and the same code is familiar from Microsoft Store downloads and activation, which share the secure channel. The number one real-world cause is a wrong system clock.
netsh winhttp reset proxy. A stale proxy breaks the secure channel for the update client specifically. Also remove any manual proxy under Settings → Network and internet → Proxy that you do not deliberately use.If the code appears across Store, activation, and updates simultaneously even with a correct clock, reset the network stack (netsh winsock reset and netsh int ip reset, then restart) and run a full malware scan, since connection interception is also a malware technique. A failing CMOS battery is the hidden cause when the clock is wrong again after every shutdown on an older desktop.
Why would my clock being wrong break updates? TLS security depends on certificates with validity dates. If your clock says it is last year or next year, every certificate looks not-yet-valid or expired, and the client quite correctly refuses the connection. It is the cheapest possible cause and should always be checked before deeper repairs.
It happens only on my home network. What gives? Something on that network is interfering with secure connections: router-level filtering, an ISP security service, or a ‘family safety’ feature doing HTTPS inspection. Testing from a phone hotspot confirms it; the fix then lives in the router or service settings, not the PC.