Code-signing certificate expiry: renewal lead times and timestamps

A code-signing certificate that expires mid-release blocks new builds from being signed. Renewal is not instant: the certificate authority may need to re-validate your organization, and hardware token or HSM delivery adds time.

Always timestamp

On Windows, Microsoft says to time-stamp signatures: without a timestamp, the signature becomes invalid when the certificate expires and Windows treats the file as unsigned. With a trusted timestamp, binaries signed while the certificate was valid stay verifiable. Other platforms vary, so check yours. Look for a timestamp server URL in your build script.

Plan the lead time

The CA/Browser Forum code-signing baseline limits certificates issued from March 1, 2026 to 460 days, and has required hardware-protected keys since June 1, 2023. Validity periods are short and renewal comes around often. Allow plenty of lead time and ask your authority how long validation takes.

What to record

Track the expiry date, the certificate authority, where the key lives (token, HSM, cloud service), and who can approve the renewal. The person who bought it is often not the person who runs releases.

Questions

Does expiry invalidate software I already shipped?

On Windows, not if it was timestamped when signed. Without a timestamp, the signature becomes invalid at expiry.

Track this in the free tracker

Guides last checked 2026-10-18. Check the details against your vendor's current documentation; products and policies change.