Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Is Forcing Enterprise SSL Certificate Rotation
Transcript
- Lucas: Alright Luna, let's talk about a change in Windows 11 that's going to make a lot of enterprise IT admins grumpy, but it's actually good for security in the long run. Luna: I'm ready. What's the change? Lucas: Microsoft is forcing SSL certificate rotation. I mean really forcing it. Starting with Windows 11, version 24H2, devices that are managed through Intune or Active Directory Certificate Services will see certificates automatically renewed every 90 days instead of the old multi-year lifespans. Luna: So they're killing the five-year certificate? That's a big shift. Lucas: Exactly. And it's not just a recommendation — if you're using Microsoft's certificate management tools, the default is now 90-day validity. You can extend it, but Microsoft is very clearly signaling that long-lived certificates are a security risk. If a certificate is compromised, you're exposed for years. With 90-day rotation, the window is much smaller. Luna: But I bet the real pain is when legacy apps hardcode certificate thumbprints or have pinned certificates, right? Lucas: That's the whole story. I talked to an IT director at a mid-size healthcare company last week. They have a legacy patient records app that was built in 2016. It has the server certificate's thumbprint hardcoded in a config file. When the certificate rotated automatically, the app stopped connecting. They had 12,000 failed authentication events in one day. Luna: Oof. And the fix is not trivial because you have to update every client or use something like certificate pinning with a proper fallback. Lucas: Right. And Microsoft's stance is basically: don't pin certificates. Use proper certificate validation with the trusted root store. But in the real world, a lot of internal apps — VPNs, Wi-Fi authentication, internal web portals — they all have some form of pinning or they rely on the certificate being the same for years. Luna: So what's the timeline? Is this already happening? Lucas: Windows 11 24H2 started rolling out to enterprise preview channels earlier this year, and the certificate rotation behavior is active by default if you're using Intune certificate profiles or AD CS with the new templates. The full broad deployment is expected by late 2025, but many enterprises are already seeing it in test rings. Luna: And is this only for device certificates, or also user certificates? Lucas: Both. Microsoft is pushing 90-day validity for all certificate types in the enterprise PKI — device authentication, user authentication, even code signing certificates. For code signing, they actually reduced it to 90 days starting in 2023, but now it's extending to all scenarios. Luna: So an IT admin who manages 10,000 devices now has to ensure every app that uses a certificate can handle automatic renewal every quarter. That's a huge testing burden. Lucas: It is. But the alternative is worse. The number of certificate-related security incidents — where an attacker stole a private key and then used the certificate for months — is actually pretty high. Microsoft's own Digital Crimes Unit has documented cases where compromised certificates were used for over a year before detection. Luna: So the 90-day rotation is a security best practice. But the rollout is going to cause chaos for understaffed IT teams. Lucas: Especially in industries like manufacturing or healthcare where there are a lot of embedded systems that talk to Windows servers and they don't get updated frequently. Those are the ones that will break. Luna: Is there any way to opt out? Lucas: You can override the default validity period in your certificate template or Intune policy, but Microsoft is discouraging it. They've added a warning in the admin console that says 'Using a longer validity period reduces security.' So if you choose to keep five-year certificates, you're accepting that risk. Luna: It almost feels like Microsoft is using the same approach they used with Windows 10 upgrades — force the change, give tools, but let the IT team deal with the fallout. Lucas: Exactly. And they are providing tools. There's a new PowerShell module called CertificateLifecycleManager that lets you simulate certificate renewal and test if apps break. But most IT teams don't have the bandwidth to run those simulations across all their apps. Luna: So what's the one thing an IT admin should do right now? Lucas: Audit every certificate that's deployed to Windows 11 devices, especially the ones used for Wi-Fi, VPN, and internal web servers. Check if any app or script references the certificate by thumbprint. Then create a test group in Intune with the new certificate profile and see what breaks. Luna: And for app developers? Lucas: Stop pinning certificates. Use certificate validation that relies on the certificate chain and trusted root. If you need to pin, use public key pinning with a backup key, and make sure the pinning logic can handle key rotation. Also, don't hardcode the certificate serial number or thumbprint anywhere. Luna: That sounds like a lot of work for something that was working fine before. Lucas: It is. But the alternative is the kind of breach where an attacker uses a stolen certificate to impersonate your internal server and steal data. And those breaches are hard to detect because the certificate is legitimate. Luna: So the episode is basically: Microsoft is forcing a security improvement that will break things, and you need to start testing now. Lucas: Exactly. I'd say if you haven't started testing by now, June 2026 is the time to really prioritize it. The 24H2 rollout is accelerating, and once it hits your fleet, you don't want to be caught with broken VPNs. Luna: Yeah, and speaking of the fleet — if this episode helped you avoid a cert-related outage, you know, it's the kind of thing that makes that coffee-run emergency fund worth it. Lucas: True. We keep the show ad-free, and listener support is what makes that possible. If today's episode saved you an hour of troubleshooting, consider throwing a coffee our way at buy me a coffee dot com slash fexingo. Luna: Honestly, even just knowing about this change before it hits your desktop is worth a lot. Lucas: Alright, back to the tech. One more thing I want to mention: Microsoft is also planning to enforce certificate revocation checking more strictly in future releases. So even if you keep longer-lived certificates, the CRL checking will be mandatory, which means your network needs to be able to reach the CRL distribution points. Luna: That's another potential breakage for air-gapped or restricted networks. Lucas: Exactly. So the theme is: certificate management is no longer something you can set and forget. It's now a quarterly cycle, like patching. And that's a cultural shift for many IT teams. Luna: But if it prevents one major breach, it's worth the headache. Lucas: I think so. And with the tools Microsoft is providing, plus third-party solutions, it's possible to automate most of it. The key is to start the conversation now, not when your CEO can't log into the VPN. Luna: Good advice. That's all for this episode of The Windows Podcast. Lucas: We'll be back next week with another deep dive. Stay secure, everyone.