Your Code Signing Certificate Has Expired: What Happens and What to Do
-
When a code signing certificate expires, you can no longer sign new releases, and software signed without a timestamp starts showing warnings. Here's what changes after expiry and what to do next.
-
-
*
Why This Happens More Often Now
Since March 2026, code signing certificates can be issued for a maximum of 460 days, so you'll need a new certificate roughly every 15 months. Expiry is no longer a rare event, and planning for it is part of the normal release routine. See Code Signing 2026 Industry Changes.
-
*
What Happens After Expiry
The impact depends on whether your releases were timestamped:
Situation What happens What to do Released software, signed with a timestamp The signature stays valid. Users can install and run it without new warnings. Nothing. Released software, signed without a timestamp The signature is no longer valid. Users see security warnings, and some systems block installation. Re-sign the files with a new certificate and replace them where users download them. New releases You can no longer sign them with the expired certificate. Get a new certificate before your next release. A timestamp proves that the software was signed while the certificate was still valid, which is why timestamped releases aren't affected. See Timestamping: Why Digital Signatures Need Timestamps .
-
*
What to Do Next
1. Order a new certificate. With GoGetSSL, a new code signing certificate is a separate order, not an extension of the old one. You create a new request and complete validation again, even if your company details haven't changed.
2. Re-sign anything released without a timestamp. Sign those files again with the new certificate, this time with a timestamp, and replace them on your website, update server, or store page.
3. Let users know if needed. Files already installed on users' computers can't be updated remotely. If users are seeing warnings, tell them a newly signed version is available.
4. Always timestamp from now on. Add a timestamp every time you sign, so the next expiry won't affect your existing releases.
Important: A file signed without a timestamp can't be fixed by adding a timestamp after the certificate has expired. The only solution is to sign it again with a valid certificate.
-
*
How to Avoid a Gap Next Time
Because each new certificate requires full validation, order it well before the current one expires. Validation can take several days, especially for EV, and you can keep signing with the old certificate until it expires, so starting early costs you nothing.
Tip: Set a reminder for about 30 days before your certificate's expiry date, and check that your company details in public registries are up to date before you order. Outdated information is a common reason for validation delays.
-
