Microsoft Warns Windows Code Signing Changes Could Affect Older Applications

Microsoft is warning IT teams and software developers to prepare for major changes to Windows code signing. Organizations that rely on hardcoded certificate checks or legacy cryptographic standards could face application failures if they do not adapt before the transition begins.

Windows code-signing infrastructure is a service for digitally signing Windows components, drivers, updates, and software so that users and operating systems can verify that the code genuinely comes from a trusted source and has not been altered after it was published. It relies on trusted certificates, certificate authorities, cryptographic algorithms, and validation mechanisms built into Windows to establish trust before software is installed or executed, which helps protect systems from tampered, malicious, or counterfeit applications.

New cryptographic standards could break older applications

Microsoft is making these changes as the existing Windows Production PCA 2011 certificate is set to expire in October 2026. The company also aims to strengthen security by adopting stronger cryptographic algorithms and preparing Windows for a future in which quantum computers could potentially weaken current encryption methods.

To prepare for this change, Microsoft has already begun transitioning to a replacement certificate authority. The company warns that applications tied to the old certificate could experience compatibility issues or stop working properly after the transition.

“To support evolving security and compliance requirements, Windows is moving toward stronger configurations, including RSA-3072 and SHA-384, by the end of 2026. Applications that hard-code expected signing configurations might fail during this transition,” Microsoft explained.

In 2027, Microsoft plans to introduce post-quantum cryptography by default for Windows code signing, which enables protection against future quantum-computing threats.

How IT Teams can prepare for the Windows code-signing transition

Microsoft is encouraging IT administrators to take a close look at the software running in their environments before the upcoming Windows code-signing changes take effect. Organizations should engage with key software vendors and confirm that their products use Microsoft’s supported trust-validation mechanisms. Moreover, applications that depend on fixed certificate names, thumbprints, issuers, or outdated cryptographic settings may encounter compatibility problems when Microsoft introduces new signing certificates and stronger security standards.

Additionally, IT teams should verify that vendors have tested their applications against the new certificate hierarchy and updated signing algorithms, including SHA-384-based signatures. Companies that maintain private trust stores should also ensure they have a reliable process for recognizing and deploying legitimate Microsoft certificate updates. Going forward, Microsoft recommends preparing for the upcoming transition to post-quantum cryptography.