Track how much of a certificate's validity is spent, when renewal must start and how urgent the current state is.
Renewal urgency is the remaining validity minus the lead time your process needs, and it must still leave room for the renewal itself to complete. ACME clients conventionally renew at one third of the validity remaining, which is 30 days for a 90-day certificate. Expired certificates are one of the most common causes of full outages, and they are entirely predictable — the only question is whether your renewal window is wide enough to absorb a failed attempt.
Certificate Expiry
days remaining = validity − days since issue; renewal must start at days remaining = lead time, and consumed validity = elapsed ÷ validity.
days remaining = validity − days since issue; renewal must start at days remaining = lead time, and consumed validity = elapsed ÷ validity. Renewal urgency is the remaining validity minus the lead time your process needs, and it must still leave room for the renewal itself to complete. ACME clients conventionally renew at one third of the validity remaining, which is 30 days for a 90-day certificate.
Expired certificates are one of the most common causes of full outages, and they are entirely predictable — the only question is whether your renewal window is wide enough to absorb a failed attempt.
This calculator takes 4 inputs: Total validity period, Days since issuance, Renewal lead time required, Days needed to complete renewal. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
The CA/Browser Forum has been cutting maximum TLS validity — 398 days today, with a phased reduction toward 47 days by 2029. Short lifetimes limit the damage from an undetected key compromise, but they make automated renewal mandatory rather than optional.