The shift was initiated by some industry giants and the CA/Browser Forum (CA/B Forum), which eventually led to stronger protection for private keys. This was done by ensuring that the certificates do not get easily extracted or misused.

Three years after this event happened, there is going to be another major change. This change will now focus on the lasting validity of the certificates in addition to how the certificates are stored.

New Rule: Shorter Lifespan, Stronger Security

The CA/B forum has introduced a new policy that comes into effect from March 1, 2026. According to this policy, the maximum validity of the code signing certificates has been decreased from 39 months (three years) to 460 days (about 15 months).

What’s After February 2026?

DigiCert will stop issuing 2 and 3-year public code signing certificates just before the deadline (24 February 2026) and will only issue up to 459 days of validity once the new rules kick in.

While Sectigo/Comodo/Certera are shifting to the same 459-day cap earlier in late February 2026, and changing multi-year product terms, like:

• 1-year Code Signing certificates will remain available via your current delivery method.

• Multi-year terms will require certificate re-issuance during the purchased term, because each issued certificate is limited to a maximum of 459 days, which means the certificate’s validity will no longer cover the full product term. 

• It means the order for the token and shipping will be limited to 1 year (365 days).

• HSM-based orders can be issued for 3 years, but re-issue would be required after 459 days.

Please Note: As a reseller, our cut-off date is 2-3 days before CA’s date, which is Feb 15, 2026. Kindly purchase and issue your multi-year code signing certificate on/before 15th Feb 2026 to avoid frequent renewals and continue the 39 months validity.

The shorter lifespan for the certificates will:

• Use automation and switching keys frequently.

• Strengthen the software supply chain to withstand new threats.

• To track changing cryptography and corresponding laws.

Importance of Shorter Validity

The changes have been made not to cause any inconvenience to the developers, but in order to minimize the risk.

• If the private key is compromised, the certificate with a small duration can have limited exposure.

• The certificates can also maintain cryptography with the evolving standards.

• The shorter validity can lead to the best practices for key management and certificate renewal.

This shift follows previous shifts in the certification of the SSL/TLS, where the validity periods were reduced gradually to enhance agility and trust.

Who is Affected?

No matter if you are an individual developer or a company that develops an app or uses trusted code signing certificates, it will affect you. The degree of change will be influenced by the way your signing environment is configured.

• Hardware Token Users: 🔴 High — tokens and certificates need replacement every 15 months. Shorten renewal cycles or migrate to cloud-based signing.

• Cloud Signing Service Users: 🟢 Low — automation via platforms (e.g., DigiCert KeyLocker, Azure KeyVault) handles this. Maintain existing automated workflows.

• Developers with Legacy Systems: 🟠 Moderate — manual renewals become frequent and error-prone. Update CI/CD pipelines with automatic signing APIs.

Source

460 Day Code Signing Certificate Validity: A New Era of Trust and Automation