Preparing the Windows ecosystem for next-generation code signing

What and why: Microsoft is preparing the Windows ecosystem for next-generation code signing to strengthen software supply chain security and improve trust in signed software. As cryptographic standards evolve, Microsoft is introducing newer signing technologies and guidance to help ensure the continued security and compatibility of Windows applications and drivers.   Rollout schedule: Microsoft guidance is already available. October 19, 2026: Microsoft Windows Production PCA 2011 expires. End of 2026: Windows is moving toward stronger signing configurations, including RSA-3072 and SHA-384. 2027: Windows signing will transition to post-quantum signing. Impact on your organization: Who is affected Software developers and publishers Organizations that develop and distribute internal applications IT and security administrators responsible for code-signing infrastructure What will happen Future Windows code-signing requirements will adopt stronger cryptographic protections. Organizations using existing code-signing certificates or signing workflows should review their environments and assess readiness. Software publishers might need to update certificates, tooling, or signing processes to remain aligned with future requirements. Action required/recommendations: Review your code-signing certificates, tooling, and signing workflows to understand any potential impact from future code-signing changes. Learn more at Preparing the Windows ecosystem for next-generation code signing.   Compliance considerations: Stronger signing supports evolving security and compliance requirements. Review as appropriate for your organization.