Windows retires its 2011 code-signing certificate today
Microsoft Windows Production PCA 2011, which has signed Windows boot components for fifteen years, expires on 19 October. Microsoft tells developers to stop pinning certificate identity.
Microsoft Windows Production PCA 2011 expires today, 19 October. It’s one of the certificates underpinning Windows code signing, and it’s being replaced by Microsoft Windows Production PCA 2026, already in use for Release Preview builds. A separate pair of 2011 certificates covering Secure Boot and the UEFI boot chain expired back in June.
A PC that hasn’t picked up the new certificates keeps booting and keeps taking ordinary Windows updates. What it loses is the ability to receive new protections for the early boot process, since those rely on trust anchored to a current certificate. Microsoft’s own guidance to developers is blunt: stop validating software by pinning to a specific certificate, and use supported APIs such as WinVerifyTrust to check trust instead of identity. The company is also moving Windows signing toward RSA-3072 and SHA-384 by the end of the year, ahead of a post-quantum signing transition planned for 2027.
Why it matters: if your installer, driver or update mechanism checks a specific Microsoft thumbprint rather than asking Windows whether a signature is trusted, this is the rotation that breaks it. Microsoft is telling IT admins to go back to vendors and ask whether their software pins certificates, and whether it’s been tested against the replacement cert and SHA-384 signatures.