Topic starter
24/06/2026 7:07 pm
TL;DR: The CA/Browser Forum has reduced the maximum validity period for publicly trusted code-signing certificates from 39 months to 460 days, effective March 1, 2026, according to DigiCert. The real issue is not shorter certificates but the assumption that manual renewal and static signing workflows can keep pace with faster rotation.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “Understanding the New Code-Signing Certificate Validity Change”.
By the numbers:
- The change takes effect on March 1, 2026.
Key questions
Q: What breaks when code signing certificates are left to manual renewal?
A: Manual renewal breaks when expiry windows become shorter than human workflows can reliably manage.
Q: Why do shorter code-signing lifetimes matter for software supply chain security?
A: Shorter lifetimes reduce the window in which a compromised signing key can be abused and push organisations toward more frequent key rotation.
Q: How do teams know if their signing process is ready for 460-day certificates?
A: A signing process is ready when renewal is automated, certificate ownership is explicit, and expiry dates are visible inside the release workflow.
Practitioner guidance
- Inventory every public code-signing certificate Record where each certificate is used, who owns renewal, and when it expires so no signing path depends on tribal knowledge.
- Move renewal into build automation Use ACME or certificate APIs to trigger issuance and rotation from the pipeline instead of relying on manual reminders.
- Reassess hardware-token workflows Compare token custody, renewal effort, and outage risk against managed signing services before the new limit takes effect.
Bottom line: Shorter code-signing validity changes the control model from occasional renewal to recurring lifecycle governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:15 am
Code-signing certificates now function as machine identities with a shorter governance horizon. The validity change is not just a calendar adjustment. It turns signing credentials into a lifecycle discipline that has to be owned, automated, and continuously observed. Organisations that still treat code signing as an infrequent procurement event will find the operational burden shifts into release engineering and security operations.
A question worth separating out:
Q: Should organisations keep using hardware tokens for code signing?
A: They can, but only if the renewal burden, custody controls, and operational overhead remain acceptable at a 15-month cadence. Where token handling introduces release friction or missed renewals, managed signing services may fit the lifecycle better. The decision should be based on renewal risk, not habit.
👉 Read our full editorial: Code-signing certificate validity is shrinking to 460 days