Microsoft has been updating various types of Windows certificates this year. Notable examples includeSecure Boot certificatesand some otherWindows 11 Insider certificates that just expired this month. Now, the company has issued an advisory for yet another certificate update, and delayed action may break certain apps and IT processes.
In guidance published throughKB5125813, Microsoft says that it is updating the code signing infrastructure in Windows in order to remove old certificates, modernize its signing algorithms, and prep forpost-quantum cryptography (PQC). Notably, the Windows Production Public Certificate Authority (PCA) 2011 is expiring on October 19, 2026, and will be replaced. Similarly, Microsoft is transitioning to stronger singing algorithms like RSA-3072 and SHA-384 later this year. Finally, as the PQC landscape continues to evolve, Microsoft is transitioning to an architecture that mandates rapid changes to the code signing process in order to remain secure.
Naturally, any app or IT process that relies on hardcoded algorithm names, CA monikers, hashes, or other forms of digital prints, may fail once these changes come into effect. Such methodologies may invalidate a code signing that Microsoft considers validated, simply because the validation processes are hardcoded to technologies that the Redmond tech firm has retired or certificates which it has rotated.
Microsoft has urged IT admins and application developers to review their current software to validate through approved Windows trust APIs, remain algorithm-agnostic, test certificate changes, and review private trust stores. IT admins should also keep in mind upcoming PQC changes to make sure that their existing software and upcoming is robust.
Here is a summary of the timeline from Microsoft:
IT admins and application developers really don't have a lot of time left before the aforementioned strategy kicks in, so make sure to review the current infrastructure to avoid compatibility breaks.