Original publish date: August 20, 2026
KB ID: 5125813
Important
Action required for application developers and IT administrators
Introduction
Microsoft is updating the Windows code-signing infrastructure to replace expiring certificates (CAs), strengthen signing algorithms, and prepare for post-quantum cryptography (PQC). Some applications might fail when Microsoft signing certificates or algorithms change, even when Windows considers the signed file valid and trusted. Developers and software vendors should review all certificate and signature validation operations to ensure they support cryptographic agility and are prepared for planned and future CA changes. Applications must not depend on a specific certificate name, thumbprint, issuer, key size, or digest/hash algorithm. Instead, delegate these inspections to approved APIs to ensure they remain agnostic to naming conventions and algorithm selection.
What is changing
- Windows Production CA replacement: Microsoft Windows Production PCA 2011 expires on October 19, 2026. Microsoft will transition Windows signing to a replacement CA with the same security properties in the coming weeks. Applications that pin to the old CA might fail during this transition.
- Stronger signing: To support evolving security and compliance requirements, Windows is moving toward stronger configurations, including RSA-3072 and SHA-384, by the end of 2026. Applications that hard-code expected signing configurations might fail during this transition.
- PQC transition: Windows signing will transition to post-quantum signing in 2027. The evolving landscape of PQC and customer requirements place cryptographic agility front and center in this transition. Future signing might use new algorithms and hybrid signature constructions and might require rapid changes as we adjust to the post-quantum world.
Compatibility risk
Microsoft testing has identified applications that fail after Windows signing certificates or algorithms change. Actions that can lead to compatibility failures include:
- Pinning Microsoft certificate subjects, issuers, thumbprints, serial numbers, or intermediate CAs.
- Requiring signatures to use SHA-256, RSA-2048, or another specific algorithm.
- Parsing Authenticode signatures or certificate chains directly instead of using Windows trust APIs.
- Using a private trust store that is not updated for Microsoft certificate rotations.
These methods can reject a file that Windows correctly validates as trusted. They also limit Microsoft’s ability to rotate certificates, strengthen cryptography, and transition to PQC.
Guidance for application developers
- Validate trust, not certificate identity. Determine whether Windows trusts the signature. Do not require a specific Microsoft CA, certificate name, or thumbprint unless Microsoft documents it as a supported contract.
- Use supported Windows APIs. Use WinVerifyTrust or the appropriate CryptoAPI/Crypt32 chain and policy interfaces. Avoid custom Authenticode and certificate-chain validation.
- Remain algorithm-agnostic. Do not assume that trusted Microsoft signatures always use a fixed algorithm pairing such as RSA-2048 + SHA-256.
- Test certificate changes. Validate applications against replacement Microsoft certificate hierarchies and stronger signing configurations.
- Review private trust stores. If your product maintains its own trust store, establish a process to recognize legitimate Microsoft certificate rotations.
Guidance for IT administrators
Ask critical software vendors whether their applications,
- Use supported Windows trust APIs.
- Pin Microsoft certificates or certificate authorities.
- Have been tested with replacement Microsoft signing certificates and SHA-384 signatures.
- Maintain a private trust store and have a certificate-update process.
- Have a plan for future PQC signing changes.
Timeline
- Now: The Microsoft Windows Production PCA 2011 expires on October 19, 2026. Replacement with a new PCA is underway.
- Later in 2026: Windows Production signing transitions to stronger configurations.
- 2027: Windows Production signing transitions to PQC-by-default, with considerations for down-level platforms and legacy systems.
- Ongoing: We’ll continue certificate rotations and algorithm updates as security requirements and customer requirements evolve.
Call to action
Review your validation logic now. Applications should rely on Windows trust decisions—not fixed assumptions about Microsoft certificates or cryptographic algorithms. This is necessary to remain compatible through the 2026 certificate transition and future PQC signing changes.