IT teams

Microsoft has issued an advisory to IT teams and software developers regarding significant changes in Windows code signing due to the expiration of the Windows Production PCA 2011 certificate in October 2026. The transition will involve stronger cryptographic algorithms, including RSA-3072 and SHA-384, which may cause compatibility issues for applications that rely on hardcoded certificate checks or outdated cryptographic standards. Microsoft plans to implement post-quantum cryptography by default for Windows code signing in 2027. IT administrators are encouraged to assess their software environments, confirm vendor compliance with supported trust-validation mechanisms, and ensure applications are tested against the new certificate hierarchy and signing algorithms. Organizations with private trust stores must establish processes for recognizing and deploying legitimate Microsoft certificate updates.