Microsoft and Windows components are signed by leaf certificates issued by six main issuing certificate authorities (CAs). Beginning in July 2025, these 15-year CAs begin to expire. Microsoft will ensure a smooth transition to the new issuing CAs for our partners and customers in the Windows Hardware Program.
Preproduction driver signing
The Windows Hardware Program supports partners signing drivers for use in pre-production environments. The CA that is used to sign the binaries for use in pre-production environments on the Windows Hardware Program is set to expire in July 2025, following which a new CA will be used to sign the preproduction content starting June 9, 2025. There are some important points that partners must take notice of, following this change:
- Going forward, the expiry of the signed content will not be tied to the expiry of the underlying CA. This means that any pre-production driver signed after June 9, 2025, will not come with an expiry date. This is unlike today, where preproduction content expires along with the expiration of the certificate that signed it.
- Drivers signed before June 9, 2025, will expire on July 4, 2025, as is the current model.
- April 22, 2025, May 13, 2025, and June 10, 2025 - Windows servicing releases (4D/5B/6B) ship to in-market platforms (down to Windows Server 2008) to remap existing CAs to their new CAs in WDAC/Application Control for Business policies. Partners must make sure to install these Latest Cumulative updates (LCUs) to add trust for the new preproduction signer (Microsoft Windows Component Preproduction CA 2024) to the kernel.
|
Product |
Release |
Release Date |
|
Windows 11 24H2 |
2025.04 D |
22 April 2025 |
|
Windows 11 22H2/23H2 |
2025.04 D |
22 April 2025 |
|
Windows 10 2004 |
2025.04 D |
22 April 2025 |
|
Server OS 23H2 (Zn) |
2025.05 B |
13 May 2025 |
|
Windows Server 2022 |
2025.05 B |
13 May 2025 |
|
Windows 10 1809 |
2025.05 B |
13 May 2025 |
|
Windows Server 2016 RTM (1607) |
2025.05 B |
13 May 2025 |
|
Windows 10 RTM |
2025.05 B |
13 May 2025 |
|
Windows Server 2012 R2 |
2025.06 B |
10 June 2025 |
|
Windows Server 2012 |
2025.06 B |
10 June 2025 |
|
Windows Server 2008 R2 SP1 |
2025.06 B |
10 June 2025 |
|
Windows Server 2008 SP2 |
2025.06 B |
10 June 2025 |
Timeline and key milestones
- April 22, 2025, May 13, 2025, and June 10, 2025 - Windows servicing releases (4D/5B/6B) ship to in-market platforms (down to Windows Server 2008) to remap existing CAs to their new CAs in WDAC/Application Control for Business policies. Partners must make sure to install these Latest Cumulative updates (LCUs) to add trust for the new preproduction signer (Microsoft Windows Component Preproduction CA 2024) to the kernel.
- June 9, 2025 – New content signed after this date will be signed with the new certificates, so the content will not come with an expiration date
- July 4, 2025 – Any content signed before June 9, 2025, will expire as the Microsoft Code Signing PCA 2010 and the Windows PCA 2010 expire on this day.
Microsoft