MC1458947 High
Preparing the Windows ecosystem for next-generation code signing
Summary AI-generated
Microsoft is preparing Windows for next-generation code signing, adopting stronger cryptographic standards to enhance software supply chain security.
Suggested actions AI-generated
- Review code-signing certificates, tooling, and signing workflows
- Assess readiness for stronger cryptographic requirements
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1529467 Microsoft Windows: Updates to address compromised eMudhra certificate authority keys
- MC1293483 Microsoft Secure Score: New recommendation for Secure Boot 2023 certificate readiness in Microsoft Defender for Endpoint
- MC1185931 Secure Boot playbook for certificates expiring in 2026
- MC1403212 Best practices for deploying Secure Boot certificate updates
- MC1491763 Prepare for Windows Update certificate rotation in 2027
- MC1230373 Secure Boot certificate updates: actions required ahead of June 2026 expiration
Original post from Microsoft
What and why:
Microsoft is preparing the Windows ecosystem for next-generation code signing to strengthen software supply chain security and improve trust in signed software. As cryptographic standards evolve, Microsoft is introducing newer signing technologies and guidance to help ensure the continued security and compatibility of Windows applications and drivers.
Rollout schedule:
- Microsoft guidance is already available.
- October 19, 2026: Microsoft Windows Production PCA 2011 expires.
- End of 2026: Windows is moving toward stronger signing configurations, including RSA-3072 and SHA-384.
- 2027: Windows signing will transition to post-quantum signing.
Impact on your organization:
Who is affected
- Software developers and publishers
- Organizations that develop and distribute internal applications
- IT and security administrators responsible for code-signing infrastructure
What will happen
- Future Windows code-signing requirements will adopt stronger cryptographic protections.
- Organizations using existing code-signing certificates or signing workflows should review their environments and assess readiness.
- Software publishers might need to update certificates, tooling, or signing processes to remain aligned with future requirements.
Action required/recommendations:
Review your code-signing certificates, tooling, and signing workflows to understand any potential impact from future code-signing changes. Learn more at Preparing the Windows ecosystem for next-generation code signing.
Compliance considerations:
Stronger signing supports evolving security and compliance requirements. Review as appropriate for your organization.