code signing Archives

Winsage

September 27, 2026

Windows 11’s driver signature requirement is one of the best anti-consumer security features out there

Windows 11 requires drivers to be digitally signed, a policy aimed at enhancing security by preventing unauthorized code from executing at the kernel level. This requirement, which began with Windows Vista and became mandatory with Windows 10, version 1607, has tightened over the years, especially with the introduction of UEFI Secure Boot and TPM in Windows 11. While this enforcement protects against malware and supports anti-cheat systems in gaming, it limits user autonomy and imposes significant challenges for developers, particularly those working on smaller projects. In contrast, Linux allows users more freedom to modify their systems, though this flexibility can compromise security.

Winsage

August 24, 2026

Microsoft Prepares Windows Code Signing for Stronger Cryptography

Microsoft has issued an advisory to IT teams and software developers regarding significant changes in Windows code signing due to the expiration of the Windows Production PCA 2011 certificate in October 2026. The transition will involve stronger cryptographic algorithms, including RSA-3072 and SHA-384, which may cause compatibility issues for applications that rely on hardcoded certificate checks or outdated cryptographic standards. Microsoft plans to implement post-quantum cryptography by default for Windows code signing in 2027. IT administrators are encouraged to assess their software environments, confirm vendor compliance with supported trust-validation mechanisms, and ensure applications are tested against the new certificate hierarchy and signing algorithms. Organizations with private trust stores must establish processes for recognizing and deploying legitimate Microsoft certificate updates.

Winsage

August 23, 2026

Microsoft is updating Windows Production CA, IT admins and devs should take action ASAP

Microsoft is updating its Windows certificate framework, focusing on Secure Boot certificates and the expiration of certain Windows 11 Insider certificates. A new certificate update is crucial to prevent disruptions in applications and IT processes. Microsoft is phasing out outdated certificates and modernizing signing algorithms, with the Windows Production Public Certificate Authority (PCA) 2011 set to expire on October 19, 2026. It will be replaced by a new PCA, and stronger signing algorithms like RSA-3072 and SHA-384 will be adopted later this year. Applications relying on outdated technologies may fail due to these updates. IT administrators and application developers are advised to review software, adopt algorithm-agnostic approaches, test certificate changes, and check private trust stores for issues. The timeline includes the PCA expiration in 2026, a transition to stronger configurations later that year, and a default to post-quantum cryptography (PQC) in 2027, with ongoing updates as security needs evolve.