SSL Certificate Validity Calculator
Check a requested certificate lifetime against CA/Browser Forum limits and see the renewal cadence it commits you to.
Inputs
Issuable Validity
397days
Policy Maximum
398days
Renewals per Certificate per Year
0.92
Annual Manual Effort
460hours
Compliance
Compliant with the 398-day maximum
Recommendation
Automate with ACME — 460 hours a year of manual renewal is unsustainable
Step by step
Values used
Certificate type = Public TLS server certificate; Requested validity = 397 days; Manual effort per renewal = 2 hours; Certificates in the estate = 250 certs
SSL Certificate Validity
issuable validity = min(requested, policy maximum): 398 days for public TLS, 825 for client auth, 1,185 for code signing.
Operational cost of the cadence
annual manual effort = (365 ÷ validity) × hours per renewal × certificate count.
Issuable Validity
= 397 days
Policy Maximum
= 398 days
Renewals per Certificate per Year
= 0.92
Annual Manual Effort
= 460 hours
Compliance
= Compliant with the 398-day maximum
Recommendation
= Automate with ACME — 460 hours a year of manual renewal is unsustainable
How it works
Public CAs hard-cap TLS validity at 398 days and will silently truncate a longer request, while private CAs and other certificate types have looser limits. Shorter lifetimes cut the exposure window of a compromised key but multiply the renewal count, so the total human cost scales with the estate size. The CA/Browser Forum has agreed a phased reduction of public TLS validity toward 47 days by 2029, which turns manual renewal from a nuisance into an operational impossibility.
Formulas
SSL Certificate Validity
issuable validity = min(requested, policy maximum): 398 days for public TLS, 825 for client auth, 1,185 for code signing.
- 398 days
- CA/Browser Forum Baseline Requirements maximum for public TLS
- policy maximum
- The cap your CA will enforce at issuance
- renewal effort
- Human hours per certificate per renewal
Operational cost of the cadence
annual manual effort = (365 ÷ validity) × hours per renewal × certificate count.
Frequently Asked Questions
How is SSL Certificate Validity calculated?
issuable validity = min(requested, policy maximum): 398 days for public TLS, 825 for client auth, 1,185 for code signing. Public CAs hard-cap TLS validity at 398 days and will silently truncate a longer request, while private CAs and other certificate types have looser limits. Shorter lifetimes cut the exposure window of a compromised key but multiply the renewal count, so the total human cost scales with the estate size.
Why does SSL Certificate Validity matter?
The CA/Browser Forum has agreed a phased reduction of public TLS validity toward 47 days by 2029, which turns manual renewal from a nuisance into an operational impossibility.
What values do I need to enter?
This calculator takes 4 inputs: Certificate type, Requested validity, Manual effort per renewal, Certificates in the estate. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
How short will public certificates get?
The approved schedule steps the maximum down to 200 days in March 2026, 100 days in March 2027 and 47 days in March 2029. Any estate not already issuing through ACME should plan that migration now.