CA/Browser Forum Changes: Read the Hardware Rule Carefully
The CA/Browser Forum's baseline requirements for code signing have tightened steadily since 2021, and every tightening has been marketed to developers as a reason to buy a cloud signing subscription. The rules deserve a closer read.
The Timeline
- June 2021: RSA minimum for code-signing (and timestamping) certificates moves to 3072 bits; ECC (P-256/P-384) increasingly attractive for smaller, faster signatures.
- June 2023: private keys must be generated and stored on certified hardware (FIPS 140-2 Level 2+ / Common Criteria EAL4+). Software PFX files are history.
- November 2025: Ballot CSC-31 adopted. It cuts the maximum validity of code-signing certificates from 39 months to 460 days.
- 1 March 2026: every code-signing certificate issued from this date is valid for at most 460 days (some CAs stop earlier; DigiCert caps at 459 days from 24 February 2026). Certificates issued before keep their original expiry. Plans of 1, 2 or 3 years (depending on the CA) still exist, but the certificate is re-issued each time it expires during the term, so timestamping your releases matters more than ever.
Read the Requirement Carefully
The mandate is hardware key storage — not cloud key storage. A SafeNet eToken or YubiKey shipped by your CA satisfies the exact same clause as a managed HSM subscription. The certified hardware in your desk drawer and the certified hardware in a vendor's datacenter differ mainly in one respect: who pays whom, monthly.
What Each Path Costs You
- Cloud route: certificate + service subscription + per-signature fees + internet dependency in your release path — repeating annually, repricing at the vendor's discretion.
- Token route: certificate + a token (often included by the CA) + software to automate it. The token's costs don't recur, and the next rule change doesn't reprice it.
The Automation Gap Is Solved
The genuine historical weakness of tokens (PIN prompts and single-machine attachment) is precisely what OneSigner exists to fix: the PIN entered once and kept in the service configuration (restrict that file to SYSTEM and administrators), folder-watch and API signing, remote hash signing via the AzureSignTool-compatible Key Vault proxy, and session management for unattended servers. ECC certificates (P-256/P-384) are fully supported, including direct YubiKey PIV signing.
Practical Guidance for 2026
- At renewal, take the certificate on a token, not in a vendor cloud — you can always add cloud later; extracting a key from a cloud HSM is by design impossible.
- Consider ECC: smaller keys, faster operations, already ahead of the RSA size treadmill.
- Timestamp every signature — shorter cert lifetimes make untimestamped signatures a liability.
- Automate with software you license once, so compliance changes don't become recurring line items.
Certificates with bundled OneSigner license → · 30-day trial →
Related: For what the rule means in practice when you are choosing a certificate, see our full EV code signing guide: OV versus EV, SmartScreen reputation, and a three-year cost comparison of tokens against cloud HSMs.