SSL Certificate Validity Calculator
Check a requested certificate lifetime against CA/Browser Forum limits and see the renewal cadence it commits you to.
About SSL Certificate Validity Calculator
Public CAs hard-cap TLS validity at 398 days and will silently truncate a longer request, while private CAs and other certificate types have looser limits. Shorter lifetimes cut the exposure window of a compromised key but multiply the renewal count, so the total human cost scales with the estate size. The CA/Browser Forum has agreed a phased reduction of public TLS validity toward 47 days by 2029, which turns manual renewal from a nuisance into an operational impossibility.
Formulas
SSL Certificate Validity
issuable validity = min(requested, policy maximum): 398 days for public TLS, 825 for client auth, 1,185 for code signing.
- 398 days
- CA/Browser Forum Baseline Requirements maximum for public TLS
- policy maximum
- The cap your CA will enforce at issuance
- renewal effort
- Human hours per certificate per renewal
Operational cost of the cadence
annual manual effort = (365 ÷ validity) × hours per renewal × certificate count.
Worked example
With the default values below, SSL Certificate Validity Calculator returns Issuable Validity of 397. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Certificate typeone of Public TLS server certificate, Private / internal CA TLS, Code-signing certificate, Client authentication certificate
- Public TLS server certificate
- Requested validityaccepts 1–3,650 days
- 397 days
- Manual effort per renewalaccepts 0–100 hours
- 2 hours
- Certificates in the estateminimum 1 certs
- 250 certs
Results
- Issuable Validity
- 397 days
- Policy Maximum
- 398 days
- Renewals per Certificate per Year
- 0.92
- Annual Manual Effort
- 460 hours
- Compliance
- Compliant with the 398-day maximum
- Recommendation
- Automate with ACME — 460 hours a year of manual renewal is unsustainable
Step by step
- 1Values used
- 2SSL Certificate Validity
- 3Operational cost of the cadence
- 4Issuable Validity= 397 days
- 5Policy Maximum= 398 days
- 6Renewals per Certificate per Year= 0.92
- 7Annual Manual Effort= 460 hours
- 8Compliance= Compliant with the 398-day maximum
- 9Recommendation= Automate with ACME — 460 hours a year of manual renewal is unsustainable
Assumptions and limits
- The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is SSL Certificate Validity calculated?
issuable validity = min(requested, policy maximum): 398 days for public TLS, 825 for client auth, 1,185 for code signing. Public CAs hard-cap TLS validity at 398 days and will silently truncate a longer request, while private CAs and other certificate types have looser limits. Shorter lifetimes cut the exposure window of a compromised key but multiply the renewal count, so the total human cost scales with the estate size.
Why does SSL Certificate Validity matter?
The CA/Browser Forum has agreed a phased reduction of public TLS validity toward 47 days by 2029, which turns manual renewal from a nuisance into an operational impossibility.
What values do I need to enter?
This calculator takes 4 inputs: Certificate type, Requested validity, Manual effort per renewal, Certificates in the estate. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
How short will public certificates get?
The approved schedule steps the maximum down to 200 days in March 2026, 100 days in March 2027 and 47 days in March 2029. Any estate not already issuing through ACME should plan that migration now.