Changes to Pre-Production Driver Signing

Preproduction driver signing 

The Windows Hardware Program supports partners signing drivers for use in pre-production environments. The CA that is used to sign the binaries for use in pre-production environments on the Windows Hardware Program is set to expire in July 2025, following which a new CA will be used to sign the preproduction content starting June 9, 2025. There are some important points that partners must take notice of, following this change: 

• Going forward, the expiry of the signed content will not be tied to the expiry of the underlying CA. This means that any pre-production driver signed after June 9, 2025, will not come with an expiry date. This is unlike today, where preproduction content expires along with the expiration of the certificate that signed it. 
  
• Drivers signed before June 9, 2025, will expire on July 4, 2025, as is the current model.
•  June 10, 2025 - Windows servicing releases (6B) ship to in-market platforms (down to Windows 10 RTM) to remap existing CAs to their new CAs in WDAC/Application Control for Business policies. Partners must make sure to install this Latest Cumulative update (LCU) to add trust for the new preproduction signer (Microsoft Windows Component Preproduction CA 2024) to the kernel.  

Timeline and key milestones 

• June 10, 2025 - Windows servicing releases (6B) ship to in-market platforms (down to Windows Server 2008) to remap existing CAs to their new CAs in WDAC/Application Control for Business policies. Partners must make sure to install this Latest Cumulative update (LCU) to add trust for the new preproduction signer (Microsoft Windows Component Preproduction CA 2024) to the kernel.   

• June 9, 2025 – New content signed after this date will be signed with the new certificates, so the content will not come with an expiration date.
  
  
• July 4, 2025 – Any content signed before June 9, 2025, will expire as the Microsoft Code Signing PCA 2010 and the Windows PCA 2010 expire on this day.
  
•  July 22, 2025 - Windows servicing releases (7D) ship to in-market platforms (Windows 11 24H2, Windows 11 22H2/23H2, Windows 10 2004). Partners must make sure to install this Latest Cumulative update (LCU) to add trust for the new preproduction signer (Microsoft Windows Component Preproduction CA 2024) to the kernel by default.
  
  
• August 12, 2025 - Windows servicing releases (8B) ship to in-market platforms (Server OS 23H2 (Zn), Windows Server 2022, Windows 10 1809, Windows Server 2016 RTM (1607), Windows 10 RTM). Partners must make sure to install this Latest Cumulative update (LCU) to add trust for the new preproduction signer (Microsoft Windows Component Preproduction CA 2024) to the kernel by default.

Note: Any driver signed between June 9th and their respective update date (see table above for the "update date" of your Windows version) should go through one of the following manual steps to go through: 

1. Manually overriding the trust check by selecting "Install". Selecting the "Always trust..." checkbox will prevent subsequent prompts from PNP

2. Adding the leaf certificate to the Local Computer\Trusted Publishers\Certificates cert store which can be manual or automated.