Windows code signing: Microsoft's PCA 2011 expired on 19 October - what developers should test
Microsoft has moved Windows signing to a new CA and will switch to RSA-3072 and SHA-384 later in 2026, with post-quantum signing planned for 2027. Software that pins Microsoft certificates may break.
Microsoft's Windows Production PCA 2011 - the certificate authority behind Windows' own code signatures - expired on 19 October 2026. Windows is moving to a replacement CA, and Microsoft has announced stronger signing (RSA-3072 with SHA-384) later in 2026 and post-quantum signing by default in 2027 (Microsoft KB5125813).
Who needs to act
- Software developers and vendors whose products check Windows signatures themselves - for example by pinning a Microsoft certificate's name, thumbprint or intermediate, or by assuming RSA-2048 with SHA-256.
- IT teams running security agents, backup, authentication or endpoint software: ask your vendors whether they have tested against the new hierarchy and SHA-384 signatures.
What to do
- Validate signatures through the Windows trust APIs (WinVerifyTrust / CryptoAPI) instead of parsing Authenticode or chains yourself.
- Don't hard-code certificate names, thumbprints or algorithms.
- If you keep a private trust store, make sure it accepts Microsoft's legitimate rotations.
Does this affect my own code signing certificate?
Microsoft's notice covers Microsoft's own signing chain. Code signing certificates you buy from a public CA keep working as before; it is a good moment, though, to make sure your build pipeline signs with SHA-256 or stronger and timestamps every signature, so signed files stay valid after the certificate expires.
Source: support.microsoft.com ↗