TLS certificate maximum validity by Certificate Authority: what each CA actually issues today
Per-CA table of the maximum TLS certificate validity period each publicly-trusted Certificate Authority actually issues today, with the date the current limit took effect and any announced future reductions. Many CAs issue below the CA/Browser Forum BR ceiling (currently 200 days since March 15, 2026): DigiCert cut to 199 days from February 24, 2026 (three weeks early); Let's Encrypt issues 90 days on its classic profile, 45 days on its tlsserver profile, and 6 days on its shortlived profile; Google Trust Services issues at most 93 days by CP/CPS v6.2; Amazon ACM issues 198 days; Actalis issues 184 days. Entrust sold its public certificate business to Sectigo in January 2025 (completed September 18, 2025) and no longer issues publicly-trusted TLS certificates. Buypass stopped issuing TLS certificates on October 31, 2025. No single page anywhere publishes this side-by-side; the data layer under any CA-aware planner or renewal tool must be assembled from each CA's own announcements. Answers 'what is the maximum TLS certificate validity for Let's Encrypt?', 'how long does DigiCert issue certificates?', 'which CA issues shorter certificates than the BR maximum?', 'does Google Trust Services issue 200-day certificates?', 'what CA is issuing 90-day certificates now?', and 'what happened to Entrust TLS certificates?'
4 records where two or more sources state different values. Both sides are reproduced on the record page, each with its own source and quote.
The data
| Certificate Authority | Maximum validity (days) | Still issuing TLS certificates | Notes | Profile or Product | Next announced reduction date | Effective date of current limit | Next reduction limit (days) |
|---|---|---|---|---|---|---|---|
| Actalis | 184 | yes | Certificates show a duration of 6 months; annual coverage is guaranteed through a second certificate available in the customer area after 168 days, with a 16-day activation window between the 169th and 184th day. A renewal certificate issued within 184 days carries 184 days plus the remaining period of the previous certificate (e.g. 200 days total if issued on day 169). Certificates issued before March 15, 2026 retain their original duration. | ||||
| Amazon Trust Services (ACM) | 198 | yes | A reduction from the previous lifetime of 395 days. As of March 15, 2027, the maximum lifetime will be less than 100 days; as of March 15, 2029, less than 47 days. | ACM-issued public | 2027-03-15 | ||
| Buypass | no | Last day to order, renew, or replace: 15.10.2025; last day for issuance: 31.10.2025. Existing TLS/SSL certificates remain valid until expiry; revocation and certificate status services run until 31.10.2026 (TLS/SSL) and 31.10.2027 (PSD2). | |||||
| DigiCert | 199 | yes | DigiCert's maxima are one day shorter than the CA/Browser Forum ceiling; the 99-day maximum applies between early 2027 and early 2029, with a 46-day maximum from early 2029. | 2026-02-24 | 99 | ||
| Entrust | no | Entrust sold its public certificate business to Sectigo (announced January 29, 2025); former Entrust public certificate customers are now Sectigo customers and Entrust no longer issues publicly-trusted TLS certificates. | |||||
| GlobalSignsources differ | 199 | yes | AlphaSSL | ||||
| GoDaddy | 90 | yes | 90-day certificates are available to customers with GoDaddy Websites + Marketing, Managed Hosting for WordPress, or Paylinks plans and Managed SSL subscriptions; the page states Self-Managed or Do-It-Yourself SSL certificates 'will continue with yearly validation', but the page predates the 2026 industry reduction and states no current maximum for self-managed products. | Managed SSL 90-Day | |||
| Google Trust Servicessources differ | 93 | yes | Per TLS CP/CPS section 6.3.2. SXG subscriber certificates are issued for a period of 48 days or less. A day is measured as 86,400 seconds. | ||||
| HARICA | 199 | yes | Reduction from 365 days (previously issued at up to 397 days maximum). Implemented gradually 9-13 March 2026; after 13 March all newly issued Server Certificates carry the 199-day maximum. Source is a RedIRIS (HARICA reseller partner) page reproducing HARICA's subscriber announcement verbatim; HARICA published no directly linkable page. | 2026-03-13 | |||
| IdenTrust | 200 | yes | Under the new policy, initial certificate issuance covers a period of 184 days (approximately six months), followed by a 15-day renewal window. The change was published 11/13/2025 and takes effect March 10, 2026. | ||||
| Let's Encryptsources differ | 45 | yes | Valid for only 45 days, in preparation for upcoming restrictions that will limit all certificates to at most 47 days. | tlsserver | |||
| Sectigo | 199 | yes | 199 days is described as 6 months plus extra time to renew. Domain Control Validation reuse is limited to 198 days from the same date. Sectigo acquired Entrust's public certificate business (completed September 18, 2025). | ||||
| SSL.com | 198 | yes | SSL.com issues 198 days, or the remaining duration of the certificate order, whichever is shorter; previously issued for 396 days. A purchase still represents a 12-month license period fulfilled through reissued 198-day certificates. The change took effect March 11, 2026. | ||||
| ZeroSSLsources differ | 200 | yes | Annual certificates provide one year of coverage through multiple certificate issuances; every new certificate follows the 200-day limit and requires a mid-term reissuance to cover the full 1-year period. ZeroSSL no longer offers single 1-year certificate issuances. | Annual | 2026-03-15 |
Where this came from
Every record above links the page it was taken from and quotes the sentence that states it. These are the 16 sources this dataset was assembled from.
- guide.actalis.comhttps://guide.actalis.com/faq/Certificate-Validity/Certificate-Validity
- aws.amazon.comhttps://aws.amazon.com/certificate-manager/faqs/
- buypass.comhttps://www.buypass.com/products/tls-ssl-certificates/discontinues-issuance-of-tls-ssl-certificates
- knowledge.digicert.comhttps://knowledge.digicert.com/alerts/public-tls-certificates-199-day-validity
- sectigo.comhttps://www.sectigo.com/resource-library/sectigo-acquires-entrust-public-certificate-business
- support.globalsign.comhttps://support.globalsign.com/ssl/general-information/maximum-certificate-validity
- godaddy.comhttps://www.godaddy.com/help/all-about-90-day-ssl-certificates-42440
- pki.googhttps://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html
- rediris.eshttps://www.rediris.es/tcs/news/2026/20260304-reduccion_199_dias.html
- identrust.comhttps://www.identrust.com/support/announcements
- letsencrypt.orghttps://letsencrypt.org/docs/profiles/
- letsencrypt.orghttps://letsencrypt.org/docs/faq/
- sectigo.comhttps://www.sectigo.com/resource-library/shorter-validity-periods-for-tls-certificates-and-dcv
- ssl.comhttps://www.ssl.com/blog/ssl-certificate-validity/
- zerossl.comhttps://zerossl.com/features/acme/
- help.zerossl.comhttps://help.zerossl.com/hc/en-us/articles/34330849350173-SSL-TLS-Certificate-Validity-Changes-New-200-Day-Limit-Explained
Machine-readable
- data.jsonThe whole dataset — every record with its source URL and source quote.
- Open Knowledge Format bundleOne JSON object per line — every record's frontmatter and quoted span exactly as it is held here, in one fetch.
- How this is made and checkedWhat "verified against source" does and does not mean.