BrevFeed
Sign in
← All stories
● Covered by 1 source · 1 reportMedium impact1 neutral

Microsoft to update NuGet package author-signing certificate by September 23, 2026

🔄 Updated 6h ago
Aggregated by BrevFeed releases · updated 6h ago
🔖 Save
New to BrevFeed? We gather this story from every outlet covering it into one summary — ranked by real-world impact, not just the latest headline — so you never miss what matters. What is BrevFeed? →

Key points

  • New certificate becomes default for Microsoft NuGet packages on September 23, 2026.
  • Current certificate will no longer sign new packages after the transition date.
  • Users validating packages with client policies or 'dotnet nuget verify' must update.
  • Existing packages signed with older certificates will retain their original signatures.

Certificate Transition Details

Microsoft is updating the X.509 certificate used to author-sign its NuGet packages. The new certificate will become the default for all new Microsoft NuGet packages starting September 23, 2026. Packages signed with older certificates will remain valid with their existing signatures.

Impacted Users

This change primarily affects customers who use NuGet client policies to enforce an allow list of trusted signers, including Microsoft, or those who use the dotnet nuget verify command to validate signed packages. These users must update their configurations to include the new certificate's SHA-256 fingerprint.

The new certificate's SHA-256 fingerprint is 9A1B131BEE0605433056A4EA3815478A8E177961A968C6C0027C1093D1FEB630. The current certificate's fingerprint is 566A31882BE208BE4422F7CFD66ED09F5D4524A5994F50CCC8B05EC0528C1353.

Required Actions

Users with NuGet client policies configured with signature validation mode set to 'require' and specific certificate fingerprints for Microsoft must add the new fingerprint to their trusted signers list in their nuget.config files. Similarly, those using dotnet nuget verify with explicit certificate fingerprints will need to update their commands.

Customers not using these validation methods should not be affected, as NuGet packages signed with the new certificate will install in the same manner as those signed with previous certificates.

✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →

Keep reading

security CISA Alerts on Active Exploitation of Multiple Microsoft SharePoint Vulnerabilities 1d ago dev w64devkit Adds Code Signing, Automated Releases, and Multilib Support 3d ago security Microsoft Releases Key Windows Security Updates and Support Changes 9h ago security Cloudflare moves to post-quantum cryptography with ML-KEM and ML-DSA 13d ago security Microsoft Teams to allow custom blocking of file extensions for security 5d ago

The daily brief

One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.

One email a day. Unsubscribe in one click, any time.

Today's brief

Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.

~26 min · 21 stories · Sep 23

▶ Play today's brief Listen on Spotify

New every morning, and the back catalogue is archived by date.

Primary sources

GitHub NuGet/Home

Reporting from

.NET Blog — Microsoft is updating its author-signing certificate starting September 23, 2026 💬 Discuss on HN 7h ago →

Microsoft will transition to a new author-signing certificate for its NuGet packages starting September 23, 2026. Users who validate Microsoft-signed packages via NuGet client policies or the dotnet nuget verify command must update their configurations to include the new certificate fingerprint to avoid disruptions.