Example 1
- notBefore 2024-01-01
- notAfter 2024-03-31
90
How many days from 2024-01-01 to 2024-03-31? 90. Two dates, not a live CA.
SSL Certificate Validity
Type notBefore and notAfter. 2024-01-01 to 2024-03-31 give 90. 2024-01-01 to 2025-01-01 give 366. 2023-01-01 to 2024-01-01 give 365. Two dates, not a live CA.
(notAfter minus notBefore) / 86400000. Not a live certificate. Days to one date sit on SSL Certificate Expiry.
Results
Enter data and click Calculate.
How it works
SSL Certificate Validity in this calculator counts days between two typed dates. 2024-01-01 to 2024-03-31 give 90. 2024-01-01 to 2025-01-01 give 366. 2023-01-01 to 2024-01-01 give 365. A span, not a live CA.
Field ssl-not-before and field ssl-not-after are dates. 31 March minus 1 January 2024 is 90. Leap year 2024 is 366. Plain 2023 is 365. The calculator does not read PEM.
90 does not come from openssl. 366 is not a Let's Encrypt probe. 365 does not know OCSP. You type both dates. There is no live CA.
SSL Certificate Expiry next door counts one date versus a reference day. Unix converts a stamp. Here 2024-01-01 and 2024-03-31 stay 90, the span alone.
Type 2024-01-01 and 2024-03-31, then Calculate. The result is 90. Reversed dates break the window. This is not a live certificate.
2024-01-01 to 2024-03-31 give 90. 2024-2025 give 366. 2023-2024 give 365. Another notAfter at 2024-01-01 changes 90.
Formula
days = round((notAfter - notBefore) / 86400000). Two typed dates, not a live CA.
How to use
- Type notBefore 2024-01-01 and notAfter 2024-03-31.
- Click Calculate. The result is 90.
- 2024-01-01 to 2025-01-01 give 366. 2023-01-01 to 2024-01-01 give 365.
- Two dates, not a live CA.
- Days to one date sit on SSL Certificate Expiry.
2024-01-01 to 2024-03-31 = 90
Two dates, not a live CA. 2024-01-01 to 2024-03-31 give 90.
- SSL
- A day window. 2023-2024 give 365. Not a handshake.
- Certificate
- Two typed dates. 2024-2025 give 366. Not a live CA.
- Validity
- The notBefore and notAfter span. 90 from 2024-03-31. Not PEM.
Examples
Example 2
- notBefore 2024-01-01
- notAfter 2025-01-01
366
What about 2024-01-01 to 2025-01-01? 366.
Example 3
- notBefore 2023-01-01
- notAfter 2024-01-01
365
What about 2023-01-01 to 2024-01-01? 365.
Related calculators
Common questions
How many days from 2024-01-01 to 2024-03-31?
90. Two typed dates, not a live CA.
What about 2024-01-01 to 2025-01-01?
366. 2024 is a leap year.
What about 2023-01-01 to 2024-01-01?
365. A common year.
Is this a live certificate?
No. Two date fields. The calculator does not call a CA and does not read PEM.
Is 90 a CA/Browser Forum month cap?
No. The day difference alone. The Forum stays off the formula.
What if notAfter is earlier?
The window breaks or goes negative. Type notAfter after notBefore.
Does 366 know OCSP?
No. Two dates only. No revocation status.
Where do I count days to one date?
On SSL Certificate Expiry. Here 90 from 2024-03-31 stays.
Does a blank date count?
No. Both fields need a date. This is not a live CA.
Knowledge sources
The calculator counts bits, bytes or throughput from your numbers. Below are SI and bit definitions (NIST).
Page updated in 2026.
What the validity window is
This calculator answers: how long is the certificate valid overall — from notBefore to notAfter. That is lifetime span, not a countdown of days remaining. Results show the span in days (plus ~months/years) and whether today sits inside the window.
CA/Browser Forum keeps shortening lifetimes
- 2020: maximum validity for public DV/OV/EV certificates capped at 398 days.
- Subsequent CA/B Forum ballots outline further staged reductions — toward 200 days, then as low as 47 days on a schedule through 2029.
- Rationale: a shorter window limits the blast radius if a private key leaks or a CA makes a validation mistake.
The 90-day model (Let’s Encrypt)
Let’s Encrypt has issued 90-day certificates from the start, betting on automated renewal rather than manual work. That design got ahead of the trend the CA/Browser Forum is now pushing across the whole industry — a shorter window means less risk surface, but only if renewal is automated.
ACME automation
- The ACME protocol (RFC 8555) automates issuance and renewal — certbot, acme.sh, and built-in integrations in Caddy, Traefik, and cloud load balancers.
- At shorter windows (90 days or less), manual renewal simply doesn’t scale — automation becomes a requirement, not a nice-to-have.
- Good practice: alerting when automated renewal fails silently (e.g. a broken DNS or HTTP-01 challenge).
Operational implications
Shorter validity windows mean more frequent rollouts and a greater need for monitoring. Measure the current certificate’s lifetime against your policy — near 398 days means upcoming CA/B Forum caps will hurt without automation.
Mini checklist:
- Plan renewal before the window ends — not on the last day.
- Automate when you can (ACME, certbot, CI scripts).
- Monitor expiry dates in dashboards / alerts.
- After renewal, verify the full chain on production.
Reference: typical validity windows
Enter the same dates in the form to see days / months / years.
| Typical length | notBefore (example) | notAfter (example) | Days |
|---|---|---|---|
| ~90 days (ACME / LE) | 2026-01-01 | 2026-04-01 | 90 |
| ~180 days | 2026-01-01 | 2026-07-01 | 181 |
| ~365 days | 2026-01-01 | 2027-01-01 | 365 |
| ~397–398 days (CA/B cap) | 2025-06-01 | 2026-07-04 | ~398 |
Examples
- notBefore 2026-01-01, notAfter 2026-04-01 → window ~90 days (typical for Let’s Encrypt).
- notBefore 2025-06-01, notAfter 2026-07-04 → window ~398 days (the current CA/B Forum maximum).
- Today’s date before notBefore → certificate is "not yet valid" (rare, but possible with certificate preloading).