Code Signing Certificates Now Max 460 Days: What Changed in 2026
Since 1 March 2026, no publicly trusted code signing certificate can be issued for longer than 460 days. The limit comes from the CA/Browser Forum's Ballot CSC-31, adopted on 17 November 2025, which cut the maximum validity in the Code Signing Baseline Requirements from 39 months to 460 days. It applies to OV and EV code signing certificates from every public CA. This post explains what changed, what did not, and how to plan renewals so that a shorter certificate never interrupts a release.
The timeline
| Date | Change |
|---|---|
| 1 June 2023 | Code signing private keys must be generated and kept on certified hardware (a USB token or HSM). Exportable PFX files are no longer issued. |
| 17 November 2025 | CA/Browser Forum adopts Ballot CSC-31: maximum code signing certificate validity reduced from 39 months to 460 days. |
| 24 February 2026 | Some CAs stop early. DigiCert, for example, stopped accepting requests above 459 days on this date, one day under the new ceiling. |
| 1 March 2026 | CSC-31 takes effect. Every code signing certificate issued from this date is valid for at most 460 days (about 15 months). |
What did not change
- Certificates issued before the cut-off keep their dates. A 3-year certificate issued in 2025 stays valid until it expires; nothing is revoked or shortened.
- Files you already signed are not affected. A signature that carries an RFC 3161 timestamp stays valid after the certificate expires, because Windows checks that the certificate was valid at the time of signing. This is why timestamping every release matters more than ever.
- The hardware rule is the same. The key still lives on a token or HSM; the new limit only changes how often the certificate on that key is renewed or re-issued.
What it means in practice
A certificate that used to last three years now has to be replaced at least twice over the same period. Each replacement is a moment where a build can break:
- Scripts that select the certificate by SHA-1 thumbprint (
signtool /sha1) stop finding it, because a new certificate has a new thumbprint. - CI agents, signing servers and Key Vault style proxies that cache the public certificate keep presenting the old one.
- If the new certificate arrives late, releases go out unsigned or are held back.
- Binaries signed with the old certificate but without a timestamp stop validating the day it expires.
A renewal checklist
- Put the expiry date in a calendar with a reminder 60 days ahead. Organisation validation can take days, and longer for EV.
- Re-issue before expiry, not after. Most CAs let you renew or re-issue in the last 90 days; the new certificate is installed on your token alongside the old one.
- Update every place that names the certificate: thumbprints in build scripts, signing profiles, proxy mappings and any allow-lists.
- Sign a test file and verify it before the old certificate expires:
signtool verify /pa /v MyApp.exe Get-AuthenticodeSignature .\MyApp.exe | Format-List Status,SignerCertificate,TimeStamperCertificate - Keep timestamping on (
/tr <TSA URL> /td sha256) so everything signed with the old certificate stays valid after it expires.
Buying for two or three years still works
CSC-31 limits the life of each certificate, not how long you can buy for. A multi-year plan is now delivered as a series of certificates: the CA issues the longest certificate the rules allow and re-issues it when it runs out, until the plan ends. You keep a single order, a single price and one validation relationship, instead of buying a new certificate every year.
That is how One Sign sells code signing certificates: 1, 2 or 3-year plans, depending on what each CA offers, with the certificate re-issued free of charge each time it expires during the term. See the current range on OneSigner Certificates.
How OneSigner handles it
OneSigner keeps the token in one Windows machine and signs everything through signing profiles, so a re-issued certificate is changed in one place: pick the new certificate in the profile (the Certificate list reads it from the token), save and restart the service. Build agents that sign through OneSignTool keep the same server URL, certificate name and partner code, so pipelines need no change. Every signature is timestamped when the profile has a timestamp URL, which keeps older releases valid after the previous certificate expires. Setup steps are in the setup guide.
Sources: CA/Browser Forum, Ballot CSC-31: Maximum Validity Reduction; DigiCert, Code Signing certificates: 459-day validity.