Certificate Expiry Calculator
Track how much of a certificate's validity is spent, when renewal must start and how urgent the current state is.
Inputs
Days Until Expiry
28days
Validity Consumed
68.9%
Days Until Renewal Must Start
-2
Renewals per Year
4.06
Urgency
High
Status
Inside the renewal window — start renewal immediately
Step by step
Values used
Total validity period = 90 days; Days since issuance = 62 days; Renewal lead time required = 30 days; Days needed to complete renewal = 3 days
Certificate Expiry
days remaining = validity − days since issue; renewal must start at days remaining = lead time, and consumed validity = elapsed ÷ validity.
Days Until Expiry
= 28 days
Validity Consumed
= 68.9
Days Until Renewal Must Start
= -2
Renewals per Year
= 4.06
Urgency
= High
Status
= Inside the renewal window — start renewal immediately
How it works
Renewal urgency is the remaining validity minus the lead time your process needs, and it must still leave room for the renewal itself to complete. ACME clients conventionally renew at one third of the validity remaining, which is 30 days for a 90-day certificate. Expired certificates are one of the most common causes of full outages, and they are entirely predictable — the only question is whether your renewal window is wide enough to absorb a failed attempt.
Formula
Certificate Expiry
days remaining = validity − days since issue; renewal must start at days remaining = lead time, and consumed validity = elapsed ÷ validity.
- validity
- notBefore to notAfter span in days
- lead time
- How early your process must begin (ACME uses one third of the validity)
- slack
- Spare days after the renewal process finishes
Frequently Asked Questions
How is Certificate Expiry calculated?
days remaining = validity − days since issue; renewal must start at days remaining = lead time, and consumed validity = elapsed ÷ validity. Renewal urgency is the remaining validity minus the lead time your process needs, and it must still leave room for the renewal itself to complete. ACME clients conventionally renew at one third of the validity remaining, which is 30 days for a 90-day certificate.
Why does Certificate Expiry matter?
Expired certificates are one of the most common causes of full outages, and they are entirely predictable — the only question is whether your renewal window is wide enough to absorb a failed attempt.
What values do I need to enter?
This calculator takes 4 inputs: Total validity period, Days since issuance, Renewal lead time required, Days needed to complete renewal. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why are certificate lifetimes getting shorter?
The CA/Browser Forum has been cutting maximum TLS validity — 398 days today, with a phased reduction toward 47 days by 2029. Short lifetimes limit the damage from an undetected key compromise, but they make automated renewal mandatory rather than optional.