In October 2025, the CA/Browser Forum approved a change aimed at limiting the maximum validity period of publicly trusted Code Signing certificates from the current 39 months to 460 days (approximately 15 months). This change will take effect on March 1, 2026 and has critical implications for software supply chain security (Software Supply Chain Security).

Why is this change being introduced?

The main objectives of this decision include:

• Reducing the risk associated with private key compromise – shorter validity periods limit the time window in which a stolen key can be used to sign malicious code.
• Promoting automation in certificate management – more frequent certificate renewals require modern tools to automate processes within the DevOps lifecycle.
• Alignment with security trends – the PKI market is moving toward shorter certificate lifecycles, similar to what has already happened with SSL/TLS.

This change is part of a broader trend in which digital certificates, including TLS/SSL certificates, are shifting to short-lived models, forcing better renewal planning and modernization of security infrastructure.

Who is affected by the new validity period?

Any organization using publicly trusted Code Signing certificates will need to adapt to the new limit:

• Companies and development teams – more frequent certificate renewals require updates to operational plans and software signing schedules.
• Users of hardware tokens compliant with FIPS or Common Criteria – the biggest challenge affects teams that previously aligned certificate validity with physical token lifecycles, as renewal cycles will need to be shortened.
• Organizations using cloud-based and managed solutions – cloud signing platforms with automatic renewal, for example PKI-managed services, will experience minimal disruption because automation is already part of their standard workflows.

Key operational implications.

The shortened validity period results in concrete practical changes:

• More frequent certificate renewals – organizations should plan renewal cycles approximately every 12 months, which requires improved scheduling and automation.
• Modernization of processes and tools – legacy manual code signing processes and manual certificate renewals must be replaced with automated CI/CD pipelines and API integrations, for example using automated certificate management protocols.
• Evaluation of key storage methods – if keys are stored on physical media, organizations should consider migrating to secure, automated cloud environments, reducing renewal complexity and the risk of administrative errors.

How to prepare for the changes?

Recommended actions include:

• Reviewing the current state of Code Signing certificates – identifying expiration dates and renewal schedules.
• Assessing existing CI/CD tools and processes – modernizing pipelines to integrate automated certificate issuance and renewal mechanisms.
• Considering managed key storage environments – this reduces administrative overhead and automates renewal cycles.
• Updating internal security policies – introducing procedures for handling shorter certificate lifecycles and key management.

The reduction of the maximum validity of Code Signing certificates from 39 months to 460 days represents an important step toward improving the security of the software ecosystem. Organizations that previously ignored certificate management automation must accelerate the adoption of modern tools and processes to maintain operational compliance and minimize security risks.

Do you have questions about the upcoming changes? Our team is at your disposal.