Certificate Expiry Calculator
Track how much of a certificate's validity is spent, when renewal must start and how urgent the current state is.
About Certificate Expiry Calculator
Renewal urgency is the remaining validity minus the lead time your process needs, and it must still leave room for the renewal itself to complete. ACME clients conventionally renew at one third of the validity remaining, which is 30 days for a 90-day certificate. Expired certificates are one of the most common causes of full outages, and they are entirely predictable — the only question is whether your renewal window is wide enough to absorb a failed attempt.
Formula
Certificate Expiry
days remaining = validity − days since issue; renewal must start at days remaining = lead time, and consumed validity = elapsed ÷ validity.
- validity
- notBefore to notAfter span in days
- lead time
- How early your process must begin (ACME uses one third of the validity)
- slack
- Spare days after the renewal process finishes
Worked example
With the default values below, Certificate Expiry Calculator returns Days Until Expiry of 28. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Total validity periodaccepts 1–1,200 days
- 90 days
- Days since issuanceaccepts 0–1,200 days
- 62 days
- Renewal lead time requiredaccepts 1–180 days
- 30 days
- Days needed to complete renewalaccepts 0–60 days
- 3 days
Results
- Days Until Expiry
- 28 days
- Validity Consumed
- 68.9%
- Days Until Renewal Must Start
- -2
- Renewals per Year
- 4.06
- Urgency
- High
- Status
- Inside the renewal window — start renewal immediately
Step by step
- 1Values used
- 2Certificate Expiry
- 3Days Until Expiry= 28 days
- 4Validity Consumed= 68.9
- 5Days Until Renewal Must Start= -2
- 6Renewals per Year= 4.06
- 7Urgency= High
- 8Status= Inside the renewal window — start renewal immediately
Assumptions and limits
- The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax or fees or charges into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Certificate Expiry calculated?
days remaining = validity − days since issue; renewal must start at days remaining = lead time, and consumed validity = elapsed ÷ validity. Renewal urgency is the remaining validity minus the lead time your process needs, and it must still leave room for the renewal itself to complete. ACME clients conventionally renew at one third of the validity remaining, which is 30 days for a 90-day certificate.
Why does Certificate Expiry matter?
Expired certificates are one of the most common causes of full outages, and they are entirely predictable — the only question is whether your renewal window is wide enough to absorb a failed attempt.
What values do I need to enter?
This calculator takes 4 inputs: Total validity period, Days since issuance, Renewal lead time required, Days needed to complete renewal. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why are certificate lifetimes getting shorter?
The CA/Browser Forum has been cutting maximum TLS validity — 398 days today, with a phased reduction toward 47 days by 2029. Short lifetimes limit the damage from an undetected key compromise, but they make automated renewal mandatory rather than optional.