If you want your executable’s signature to be still valid after certificate validity period, you have to digitally sign it with a timestamp from one of the timestamp websites with /tr switch before its expiry. In my case, I choose timestamp.digicert.com. This command is for Windows only.

signtool.exe sign /tr http://timestamp.digicert.com /f Cert.pfx /p password /n "Your Name" /d "Your Description" YourApp.exe