Check a requested certificate lifetime against CA/Browser Forum limits and see the renewal cadence it commits you to.
Public CAs hard-cap TLS validity at 398 days and will silently truncate a longer request, while private CAs and other certificate types have looser limits. Shorter lifetimes cut the exposure window of a compromised key but multiply the renewal count, so the total human cost scales with the estate size. The CA/Browser Forum has agreed a phased reduction of public TLS validity toward 47 days by 2029, which turns manual renewal from a nuisance into an operational impossibility.
SSL Certificate Validity
issuable validity = min(requested, policy maximum): 398 days for public TLS, 825 for client auth, 1,185 for code signing.
Operational cost of the cadence
annual manual effort = (365 ÷ validity) × hours per renewal × certificate count.
issuable validity = min(requested, policy maximum): 398 days for public TLS, 825 for client auth, 1,185 for code signing. Public CAs hard-cap TLS validity at 398 days and will silently truncate a longer request, while private CAs and other certificate types have looser limits. Shorter lifetimes cut the exposure window of a compromised key but multiply the renewal count, so the total human cost scales with the estate size.
The CA/Browser Forum has agreed a phased reduction of public TLS validity toward 47 days by 2029, which turns manual renewal from a nuisance into an operational impossibility.
This calculator takes 4 inputs: Certificate type, Requested validity, Manual effort per renewal, Certificates in the estate. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
The approved schedule steps the maximum down to 200 days in March 2026, 100 days in March 2027 and 47 days in March 2029. Any estate not already issuing through ACME should plan that migration now.