What Happens When a Code Signing Certificate Expires?
Expiration ends the certificate's validity for new signing. It does not automatically invalidate every release that was signed before the expiration date.
validity
The Short Answer
CERTIFICATE
The expired certificate is no longer suitable for a new release. Use a current certificate that satisfies applicable requirements at signing time.
Verification considers signing time, timestamp, certificate status, chain, and platform-specific rules.
What Does Certificate Expiration Mean?
A code signing certificate has a defined validity period. Its Not Before and Not After fields establish when the certificate is valid. the certificate lifecycle, unlike revocation, which deliberately invalidates a certificate before or during its normal lifecycle.
What Happens to New Code Signing?
Do not use an expired certificate for a new release. This applies whether the publisher is signing an EXE, DLL, MSI, script/package, or a new application build.
- Signing tools may reject the expired credential.
- The signing operation may fail validation.
- A build or release pipeline can fail if it still references the old certificate.
- Platform behavior and exact error messages can vary.
What Happens to Existing Software?
Existing software must be evaluated differently. verify the signature
the timestamp can provide evidence that signing occurred while the certificate was valid.
the verifier may have less reliable evidence of when the signature was created, making long-term validation more difficult.
Why Timestamping Changes the Expiration Scenario
The visual difference is simple: without a trusted timestamp, the verifier has less evidence about when the signature was created. With one, signing-time evidence travels with the signature.
Without a Trusted Timestamp
The file was signed, but the verifier may have less reliable cryptographic evidence establishing that signing occurred during the certificate's valid period.
With a Trusted Timestamp
A trusted timestamp records evidence of signing time. The details of how that evidence works are covered in Code Signing and Timestamping Explained.
Certificate Expiration vs. Signature Validity
| Certificate expiration | Signature validity |
|---|---|
| The certificate itself is outside its defined validity period. | Whether a particular signature can still be validated depends on the signature, certificate chain, timestamp, status, and applicable verification rules. |
What a verifier is effectively checking
Can an Expired Certificate Still Verify an Old Signature?
Potentially yes. It depends on how the signature was created and how the verifier evaluates it.
Expiration vs. Revocation
| Question | Expiration | Revocation |
|---|---|---|
| Why? | Validity period ended | Certificate deliberately invalidated |
| Expected? | Yes; normal lifecycle event | Usually exceptional |
| Automatic? | Yes | No |
| Can happen before expiry? | No | Yes |
| Key compromise implied? | No | Potentially |
| Existing signatures | Depends on signing time, timestamp, status and verification rules | Depends on signing time, timestamp, revocation reason and verification rules |
Expiration is expected at the end of a validity period, whereas certificate revocation changes a certificate’s status before or during its normal lifecycle.
What Happens to the Private Key?
Certificate expires ≠ private key expires. The cryptographic key does not automatically disappear when the certificate reaches its expiration date.
- Do not use the expired certificate for new signing.
- Continue protecting the private key as sensitive material.
- For normal renewal, follow the CA/provider's current key-generation and protection requirements.
- If compromise is suspected, treat it as a security incident rather than ordinary renewal.
Do You Need to Re-Sign Existing Software?
There is no blanket rule to re-sign every previous release. Evaluate the release and its signature first.
Sign with a new valid certificate.
Check signing time, trusted timestamp, status, chain and applicable platform rules before deciding whether re-signing is necessary.
What Happens During Certificate Renewal?
Renewal is a transition between signing credentials, not a magic extension of the old certificate.
Existing certificate
Approaching expiration
Renew / apply
Identity / policy validation
New certificate + key
Update signing environment
Test → verify → release
Prepare for the next certificate before the old one expires
Compare suitable certificate options and plan the credential transition before it interrupts a release. The new certificate must meet your organization’s validation and key-protection requirements.
Should You Reuse the Existing Private Key?
Key reuse and key replacement are separate decisions. Do not present reuse as automatically preferable for a new certificate.
- CA requirements
- Current key-protection requirements
- Signing infrastructure
- Security policy
- Whether the original key remains trustworthy
- Whether the key is hardware-backed
What Happens in CI/CD?
Expiration often becomes visible first in automated release workflows.
OLD certificate
FAILS
→ test → release
New certificate → update signing configuration → test → verify → production release.
Automated release workflows need to be updated when signing credentials change. Signing software in a CI/CD pipeline helps make that transition part of the release process.
How to Check Whether a Certificate Has Expired
Inspect the certificate and signature rather than relying only on a filename, release date, or build system status.
On Windows, inspect the file's digital signature, select the signature, open its details, and inspect the signing certificate and certification path.
For a repeatable verification process, use the steps in the Windows signature verification guide to inspect the signature and certificate details.
Real-World Example
Watch the release timeline cross the certificate's expiration point. The old releases remain separate historical artifacts; the October release needs a current certificate.
What Publishers Should Do Before Expiration
Common Misconceptions
Not necessarily.
Not universally; signing time and timestamp matter.
No.
No. Timestamping helps establish signing time; it does not make an expired certificate suitable for new signing.
Not necessarily; a new certificate is generally issued through the applicable renewal/issuance process.
No.
Keep the lifecycle distinctions clear
Issuance explains how you obtain a certificate. Timestamping establishes signing time. Revocation covers deliberate invalidation. This page focuses on what changes when the normal validity period ends.