SSL Certificate Validity
Enter the notBefore and notAfter dates from an SSL/TLS certificate to calculate the validity window length in days, months, and years, and check whether the certificate is active today — with CA/Browser Forum lifetime context.
Results
Enter data and click Calculate.
What the validity window is
This calculator answers: how long is the certificate valid overall — from notBefore to notAfter. That is lifetime span, not a countdown of days remaining. Results show the span in days (plus ~months/years) and whether today sits inside the window.
CA/Browser Forum keeps shortening lifetimes
- 2020: maximum validity for public DV/OV/EV certificates capped at 398 days.
- Subsequent CA/B Forum ballots outline further staged reductions — toward 200 days, then as low as 47 days on a schedule through 2029.
- Rationale: a shorter window limits the blast radius if a private key leaks or a CA makes a validation mistake.
The 90-day model (Let’s Encrypt)
Let’s Encrypt has issued 90-day certificates from the start, betting on automated renewal rather than manual work. That design got ahead of the trend the CA/Browser Forum is now pushing across the whole industry — a shorter window means less risk surface, but only if renewal is automated.
ACME automation
- The ACME protocol (RFC 8555) automates issuance and renewal — certbot, acme.sh, and built-in integrations in Caddy, Traefik, and cloud load balancers.
- At shorter windows (90 days or less), manual renewal simply doesn’t scale — automation becomes a requirement, not a nice-to-have.
- Good practice: alerting when automated renewal fails silently (e.g. a broken DNS or HTTP-01 challenge).
Operational implications
Shorter validity windows mean more frequent rollouts and a greater need for monitoring. Measure the current certificate’s lifetime against your policy — near 398 days means upcoming CA/B Forum caps will hurt without automation.
Mini checklist:
- Plan renewal before the window ends — not on the last day.
- Automate when you can (ACME, certbot, CI scripts).
- Monitor expiry dates in dashboards / alerts.
- After renewal, verify the full chain on production.
Reference: typical validity windows
Enter the same dates in the form to see days / months / years.
| Typical length | notBefore (example) | notAfter (example) | Days |
|---|---|---|---|
| ~90 days (ACME / LE) | 2026-01-01 | 2026-04-01 | 90 |
| ~180 days | 2026-01-01 | 2026-07-01 | 181 |
| ~365 days | 2026-01-01 | 2027-01-01 | 365 |
| ~397–398 days (CA/B cap) | 2025-06-01 | 2026-07-04 | ~398 |
Examples
- notBefore 2026-01-01, notAfter 2026-04-01 → window ~90 days (typical for Let’s Encrypt).
- notBefore 2025-06-01, notAfter 2026-07-04 → window ~398 days (the current CA/B Forum maximum).
- Today’s date before notBefore → certificate is "not yet valid" (rare, but possible with certificate preloading).
FAQ — certificate validity window
- How is this different from the "days until expiry" calculator?
- That one counts down to a single date. This one measures the certificate’s full span (notBefore → notAfter) and checks whether today falls inside it.
- Where do I find notBefore and notAfter?
- In browser certificate details: "Valid from" / "Valid to". To read both dates at once:
openssl x509 -dates -noout -in cert.pem(the days-until-expiry tool focuses on-enddate). - Why is the window shorter than a year?
- Since 2020 the CA/Browser Forum has capped public certificates at 398 days, and later ballots outline further reductions toward just a few dozen days.
- Is a 90-day window a misconfiguration?
- No — it’s the standard Let’s Encrypt/ACME model, designed for automated renewal rather than manual work.
- What does the "not yet valid" status mean?
- Today’s date falls before notBefore — the certificate technically exists, but clients won’t accept it as valid yet.
- Are the months and years exact?
- They’re approximations (days ÷ 30.44 and days ÷ 365.25) good for comparisons; the exact day count is in the "Days" field.
- Can I use this for internal CA certificates?
- Yes — the calculator works on any two dates, regardless of who issued the certificate.
- How does this connect to ACME automation?
- Knowing the window length makes it easier to schedule renewal (e.g. at 2/3 of the window) so automation has margin to retry on failures.