TLS certificate maximum validity by Certificate Authority: what each CA actually issues today
Per-CA table of the maximum TLS certificate validity period each publicly-trusted Certificate Authority actually issues today, with the date the current limit took effect and any announced future reductions. Many CAs issue below the CA/Browser Forum BR ceiling (currently 200 days since March 15, 2026): DigiCert cut to 199 days from February 24, 2026 (three weeks early); Let's Encrypt issues 90 days on its classic profile, 45 days on its tlsserver profile, and 6 days on its shortlived profile; Google Trust Services issues at most 93 days by CP/CPS v6.2; Amazon ACM issues 198 days; Actalis issues 184 days. Entrust sold its public certificate business to Sectigo in January 2025 (completed September 18, 2025) and no longer issues publicly-trusted TLS certificates. Buypass stopped issuing TLS certificates on October 31, 2025. No single page anywhere publishes this side-by-side; the data layer under any CA-aware planner or renewal tool must be assembled from each CA's own announcements. Answers 'what is the maximum TLS certificate validity for Let's Encrypt?', 'how long does DigiCert issue certificates?', 'which CA issues shorter certificates than the BR maximum?', 'does Google Trust Services issue 200-day certificates?', 'what CA is issuing 90-day certificates now?', and 'what happened to Entrust TLS certificates?'
The data
| Certificate Authority | Maximum validity (days) | Still issuing TLS certificates | Notes | Profile or Product | Next announced reduction date | Effective date of current limit | Next reduction limit (days) |
|---|---|---|---|---|---|---|---|
| Actalis | 184 | yes | Certificates show a duration of 6 months; annual coverage is guaranteed through a second certificate available in the customer area after 168 days, with a 16-day activation window between the 169th and 184th day. A renewal certificate issued within 184 days carries 184 days plus the remaining period of the previous certificate (e.g. 200 days total if issued on day 169). Certificates issued before March 15, 2026 retain their original duration. | ||||
| Amazon Trust Services (ACM) | 198 | yes | A reduction from the previous lifetime of 395 days. As of March 15, 2027, the maximum lifetime will be less than 100 days; as of March 15, 2029, less than 47 days. | ACM-issued public | 2027-03-15 | ||
| Buypass | no | Last day to order, renew, or replace: 15.10.2025; last day for issuance: 31.10.2025. Existing TLS/SSL certificates remain valid until expiry; revocation and certificate status services run until 31.10.2026 (TLS/SSL) and 31.10.2027 (PSD2). | |||||
| DigiCert | 199 | yes | DigiCert's maxima are one day shorter than the CA/Browser Forum ceiling; the 99-day maximum applies between early 2027 and early 2029, with a 46-day maximum from early 2029. | 2026-02-24 | 99 | ||
| Entrust | no | Entrust sold its public certificate business to Sectigo (announced January 29, 2025); former Entrust public certificate customers are now Sectigo customers and Entrust no longer issues publicly-trusted TLS certificates. | |||||
| GlobalSign | 199 | yes | AlphaSSL | ||||
| GlobalSign | 199 | yes | DomainSSL | ||||
| GlobalSign | 199 | yes | ExtendedSSL | ||||
| GlobalSign | 199 | yes | OrganizationSSL | ||||
| GlobalSign | 199 | yes | Effective March 15, 2026, certificates issued on or after this date are limited by the CA/B Forum Baseline Requirements to a maximum validity of 200 days; GlobalSign's product table lists 199 days for all TLS products. | CloudSSL | |||
| GoDaddy | 90 | yes | 90-day certificates are available to customers with GoDaddy Websites + Marketing, Managed Hosting for WordPress, or Paylinks plans and Managed SSL subscriptions; the page states Self-Managed or Do-It-Yourself SSL certificates 'will continue with yearly validation', but the page predates the 2026 industry reduction and states no current maximum for self-managed products. | Managed SSL 90-Day | |||
| Google Trust Services | 93 | yes | Per TLS CP/CPS section 6.3.2. SXG subscriber certificates are issued for a period of 48 days or less. A day is measured as 86,400 seconds. | ||||
| Google Trust Services | 48 | yes | Signed Exchange (SXG) subscriber certificates, per TLS CP/CPS section 6.3.2. | SXG subscriber | |||
| HARICA | 199 | yes | Reduction from 365 days (previously issued at up to 397 days maximum). Implemented gradually 9-13 March 2026; after 13 March all newly issued Server Certificates carry the 199-day maximum. Source is a RedIRIS (HARICA reseller partner) page reproducing HARICA's subscriber announcement verbatim; HARICA published no directly linkable page. | 2026-03-13 | |||
| IdenTrust | 200 | yes | Under the new policy, initial certificate issuance covers a period of 184 days (approximately six months), followed by a 15-day renewal window. The change was published 11/13/2025 and takes effect March 10, 2026. | ||||
| Let's Encrypt | 45 | yes | Valid for only 45 days, in preparation for upcoming restrictions that will limit all certificates to at most 47 days. | tlsserver | |||
| Let's Encrypt | 6 | yes | Validity Period is stated as 160 hours in the profile table; qualifies as a Short-Lived Subscriber Certificate under the Baseline Requirements and needs no revocation information. | shortlived | |||
| Let's Encrypt | 90 | yes | The FAQ states the default lifetime; the profiles documentation names the default profile 'classic'. Let's Encrypt recommends renewing 90 day certificates every 60 days. There is no way to adjust these lifetimes. | classic | |||
| Sectigo | 199 | yes | 199 days is described as 6 months plus extra time to renew. Domain Control Validation reuse is limited to 198 days from the same date. Sectigo acquired Entrust's public certificate business (completed September 18, 2025). | ||||
| SSL.com | 198 | yes | SSL.com issues 198 days, or the remaining duration of the certificate order, whichever is shorter; previously issued for 396 days. A purchase still represents a 12-month license period fulfilled through reissued 198-day certificates. The change took effect March 11, 2026. | ||||
| ZeroSSL | 200 | yes | Annual certificates provide one year of coverage through multiple certificate issuances; every new certificate follows the 200-day limit and requires a mid-term reissuance to cover the full 1-year period. ZeroSSL no longer offers single 1-year certificate issuances. | Annual | 2026-03-15 | ||
| ZeroSSL | 90 | yes | Free ACME-issued certificates are 90 days, renewable automatically with any major ACME client. | ACME/free |
Where this came from
Every record above links the page it was taken from and quotes the sentence that states it. These are the 16 sources this dataset was assembled from.
- guide.actalis.comhttps://guide.actalis.com/faq/Certificate-Validity/Certificate-Validity
- aws.amazon.comhttps://aws.amazon.com/certificate-manager/faqs/
- buypass.comhttps://www.buypass.com/products/tls-ssl-certificates/discontinues-issuance-of-tls-ssl-certificates
- knowledge.digicert.comhttps://knowledge.digicert.com/alerts/public-tls-certificates-199-day-validity
- sectigo.comhttps://www.sectigo.com/resource-library/sectigo-acquires-entrust-public-certificate-business
- support.globalsign.comhttps://support.globalsign.com/ssl/general-information/maximum-certificate-validity
- godaddy.comhttps://www.godaddy.com/help/all-about-90-day-ssl-certificates-42440
- pki.googhttps://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html
- rediris.eshttps://www.rediris.es/tcs/news/2026/20260304-reduccion_199_dias.html
- identrust.comhttps://www.identrust.com/support/announcements
- letsencrypt.orghttps://letsencrypt.org/docs/profiles/
- letsencrypt.orghttps://letsencrypt.org/docs/faq/
- sectigo.comhttps://www.sectigo.com/resource-library/shorter-validity-periods-for-tls-certificates-and-dcv
- ssl.comhttps://www.ssl.com/blog/ssl-certificate-validity/
- help.zerossl.comhttps://help.zerossl.com/hc/en-us/articles/34330849350173-SSL-TLS-Certificate-Validity-Changes-New-200-Day-Limit-Explained
- zerossl.comhttps://zerossl.com/features/acme/
Machine-readable
- data.jsonThe whole dataset — every record with its source URL and source quote.
- Open Knowledge Format bundleOne JSON object per line — every record's frontmatter and quoted span exactly as it is held here, in one fetch.
- data.csvThe same records as one flat table, for a spreadsheet or a dataframe. The last four columns are the source URL, the quoted sentence it was read from, the date we last checked it, and which columns are our reading rather than the page's words.
- How this is made and checkedWhat "verified against source" does and does not mean.
From your own code
Same records, same quotes, without scraping the page: refsource is on PyPI and npm. Each value comes back carrying the URL it was read from and the sentence on that page that states it — .source and .quote sit on the value itself rather than in a side channel, so the checking step is available instead of skipped.
pip install refsource
refsource lookup ca-issuance-validity ca_name=Actalis
npx -y refsource lookup ca-issuance-validity ca_name=ActalisSet your AI assistant up to use this
Two files and no account. Put this in .mcp.json at the root of your project — Claude Code, Cursor, Windsurf, VS Code and Codex all read that file — and your assistant can look this dataset up instead of recalling it. The server is remote, keyless and read-only.
{
"mcpServers": {
"referencesource": {
"type": "http",
"url": "https://referencesource.org/mcp"
}
}
}Add to Cursor · or, on the command line: claude mcp add --transport http referencesource https://referencesource.org/mcp --scope project
Then one line in the project's CLAUDE.md or AGENTS.md, so the assistant knows when to reach for it:
When a question needs "TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", call the referencesource MCP server at https://referencesource.org/mcp (tool `search_records`, dataset_slug `ca-issuance-validity`) instead of answering from memory — every record it returns carries its source URL and a verbatim quote from that page.What each tool does, and the servers built over single registers: Connect your AI assistant.