www.it-connect.fr
Is Windows Code Signing Ready for the Post-Quantum Shift?
Microsoft has published a new support document outlining upcoming changes to its code-signing infrastructure for Windows. Most notably, Microsoft is discussing major changes to move toward post-quantum cryptography. This could have side effects for certain applications. Here’s what you need to know.
Three closely spaced deadlines, including one in less than two months
After the expiration of Secure Boot certificates, Microsoft has decided to tackle another piece of the puzzle: the code-signing infrastructure for Windows. Once again, certificates are involved. The new document (KB5125813) published by Microsoft contains some interesting information, and most importantly, a timeline. Microsoft presents its roadmap in three phases, with the first deadline coming very soon:
- October 2026: the Microsoft Windows Production PCA 2011 certification authority expires on October 19, 2026. Microsoft says the transition to a new authority with the same security properties is already underway and will take place in the coming weeks.
- End of 2026: Windows signing will adopt stronger configurations, notably RSA-3072 and SHA-384, in response to evolving security and compliance requirements.
- In 2027: Windows production code-signing infrastructure will move to post-quantum by default. Microsoft plans "adjustments" for older platforms and legacy systems.
Throughout this timeline: "We will continue to renew certificates and update algorithms as security requirements and customer needs evolve," Microsoft says. In the end, not everything is set in stone. Future signatures could rely on new algorithms and hybrid signature constructions, with the possibility of rapid changes as the post-quantum ecosystem stabilizes.
This is not the first time Microsoft has talked about post-quantum cryptography. On June 30, 2026, Microsoft also announced an acceleration of its Quantum Safe program, with the goal of moving its critical products and services to post-quantum cryptography by 2029. Applying this approach to code signing on Windows follows the same logic.
In addition, Microsoft has been working on Windows integration for months. For example, the ML-KEM and ML-DSA algorithms have been integrated into Windows APIs, as we detailed in our roundup of November 2025 Windows Server updates.
The real risk: applications with hard-coded values
Will this change from Microsoft have side effects? The answer is yes. Let’s hope it does not cause too much chaos, but the Redmond company is already warning everyone. Its own tests have identified applications that stop working as soon as the certificate or signing algorithm changes, even though Windows correctly validates the signed file. This change could therefore block some applications.
Microsoft cites the following reasons in particular:
- Hard-coding the subjects, issuers, fingerprints, serial numbers, or intermediate authorities of Microsoft certificates.
- Requiring signatures to use SHA-256, RSA-2048, or any other specific algorithm.
- Directly parsing Authenticode signatures or certificate chains instead of relying on Windows trust APIs.
- Maintaining a private trust store that is not updated when Microsoft certificates are rotated.
In other words, applications that handle certificates and certificate validation too rigidly will struggle to migrate to post-quantum.
Microsoft recommends that developers and vendors adapt their applications. For example, it is recommended to use the appropriate APIs (such as WinVerifyTrust) rather than implementing custom Authenticode validation. It is also recommended to remain algorithm-agnostic, without assuming that Microsoft signatures will always use the RSA-2048 and SHA-256 pair.
Finally, it is worth noting that this change will affect Windows 10, Windows 11, and Windows Server (2012 to 2025). A hot topic to keep an eye on in the coming months.
