Code signing certificates now last at most 460 days
Since 1 March 2026 public code signing and EV code signing certificates can be issued for at most 460 days (Ballot CSC-31). Multi-year needs are covered by renewing or reissuing.
The CA/Browser Forum's Code Signing Working Group passed Ballot CSC-31, cutting the maximum validity of publicly trusted code signing certificates from 39 months to 460 days. The limit has applied to every certificate issued since 1 March 2026; some CAs apply it a few days earlier or one day shorter.
What changes for you
- New code signing and EV code signing certificates are issued for at most about 15 months.
- Certificates issued before the change keep their original expiry date.
- A reissue of an older multi-year certificate may be shortened to the new maximum.
Keep your signed software valid
- Always timestamp. A timestamped signature stays valid after the certificate expires; an untimestamped one does not.
- Plan renewals. Put the expiry date in your release calendar - keys for code signing live on a hardware token or cloud HSM, so allow time for delivery or set-up.
- Automate where you can. Cloud signing services make yearly renewals far less disruptive than swapping USB tokens.
Source: knowledge.digicert.com ↗