{"asset": "ca-issuance-validity", "asset_type": "validity-period", "body": "Per-CA table of the maximum TLS certificate validity period each publicly-trusted Certificate Authority actually issues today, with the date the current limit took effect and any announced future reductions. Many CAs issue below the CA/Browser Forum BR ceiling (currently 200 days since March 15, 2026): DigiCert cut to 199 days from February 24, 2026 (three weeks early); Let's Encrypt issues 90 days on its classic profile, 45 days on its tlsserver profile, and 6 days on its shortlived profile; Google Trust Services issues at most 93 days by CP/CPS v6.2; Amazon ACM issues 198 days; Actalis issues 184 days. Entrust sold its public certificate business to Sectigo in January 2025 (completed September 18, 2025) and no longer issues publicly-trusted TLS certificates. Buypass stopped issuing TLS certificates on October 31, 2025. No single page anywhere publishes this side-by-side; the data layer under any CA-aware planner or renewal tool must be assembled from each CA's own announcements. Answers 'what is the maximum TLS certificate validity for Let's Encrypt?', 'how long does DigiCert issue certificates?', 'which CA issues shorter certificates than the BR maximum?', 'does Google Trust Services issue 200-day certificates?', 'what CA is issuing 90-day certificates now?', and 'what happened to Entrust TLS certificates?'\n", "description": "Per-CA table of the maximum TLS certificate validity period each publicly-trusted Certificate Authority actually issues today, with the date the current limit took effect and any announced future reductions. Many CAs issue below the CA/Browser Forum BR ceiling (currently 200 days since March 15, 2026): DigiCert cut to 199 days from February 24, 2026 (three weeks early); Let's Encrypt issues 90 days on its classic profile, 45 days on its tlsserver profile, and 6 days on its shortlived profile; Google Trust Services issues at most 93 days by CP/CPS v6.2; Amazon ACM issues 198 days; Actalis issues 184 days. Entrust sold its public certificate business to Sectigo in January 2025 (completed September 18, 2025) and no longer issues publicly-trusted TLS certificates. Buypass stopped issuing TLS certificates on October 31, 2025. No single page anywhere publishes this side-by-side; the data layer under any CA-aware planner or renewal tool must be assembled from each CA's own announcements. Answers 'what is the maximum TLS certificate validity for Let's Encrypt?', 'how long does DigiCert issue certificates?', 'which CA issues shorter certificates than the BR maximum?', 'does Google Trust Services issue 200-day certificates?', 'what CA is issuing 90-day certificates now?', and 'what happened to Entrust TLS certificates?'", "file": "index.md", "generated": true, "harvested": "2026-08-18", "key_field": "ca_name", "licence": "Facts extracted from each CA's own publicly-published documentation, announcements, and certification practice statements. Certificate validity limits are regulatory facts, not creative expression. Each record quotes a short verbatim span and links to the CA's own page.", "sources": ["https://guide.actalis.com/faq/Certificate-Validity/Certificate-Validity", "https://aws.amazon.com/certificate-manager/faqs/", "https://www.buypass.com/products/tls-ssl-certificates/discontinues-issuance-of-tls-ssl-certificates", "https://knowledge.digicert.com/alerts/public-tls-certificates-199-day-validity", "https://www.sectigo.com/resource-library/sectigo-acquires-entrust-public-certificate-business", "https://support.globalsign.com/ssl/general-information/maximum-certificate-validity", "https://www.godaddy.com/help/all-about-90-day-ssl-certificates-42440", "https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html", "https://www.rediris.es/tcs/news/2026/20260304-reduccion_199_dias.html", "https://www.identrust.com/support/announcements", "https://letsencrypt.org/docs/profiles/", "https://letsencrypt.org/docs/faq/", "https://www.sectigo.com/resource-library/shorter-validity-periods-for-tls-certificates-and-dcv", "https://www.ssl.com/blog/ssl-certificate-validity/", "https://zerossl.com/features/acme/", "https://help.zerossl.com/hc/en-us/articles/34330849350173-SSL-TLS-Certificate-Validity-Changes-New-200-Day-Limit-Explained"], "stale_after": "2026-09-17", "title": "TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "dataset", "verified": false} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** Actalis\n\n**Maximum validity (days):** 184\n\n**Still issuing TLS certificates:** yes\n\n**Notes:** Certificates show a duration of 6 months; annual coverage is guaranteed through a second certificate available in the customer area after 168 days, with a 16-day activation window between the 169th and 184th day. A renewal certificate issued within 184 days carries 184 days plus the remaining period of the previous certificate (e.g. 200 days total if issued on day 169). Certificates issued before March 15, 2026 retain their original duration.\n\n> Yes. If renewal occurs within 184 days, a renewal certificate is issued with a duration equal to 184 days plus the remaining period of the previous certificate.\n\nSource: \n", "ca_name": "Actalis", "file": "actalis.md", "generated": true, "harvested": "2026-08-18", "id": "actalis", "max_validity_days": "184", "notes": "Certificates show a duration of 6 months; annual coverage is guaranteed through a second certificate available in the customer area after 168 days, with a 16-day activation window between the 169th and 184th day. A renewal certificate issued within 184 days carries 184 days plus the remaining period of the previous certificate (e.g. 200 days total if issued on day 169). Certificates issued before March 15, 2026 retain their original duration.", "source_quote": "Yes. If renewal occurs within 184 days, a renewal certificate is issued with a duration equal to 184 days plus the remaining period of the previous certificate.", "sources": ["https://guide.actalis.com/faq/Certificate-Validity/Certificate-Validity"], "stale_after": "2026-09-17", "still_active": "yes", "title": "Actalis \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** Amazon Trust Services (ACM)\n\n**Profile or Product:** ACM-issued public\n\n**Maximum validity (days):** 198\n\n**Next announced reduction date:** 2027-03-15\n\n**Still issuing TLS certificates:** yes\n\n**Notes:** A reduction from the previous lifetime of 395 days. As of March 15, 2027, the maximum lifetime will be less than 100 days; as of March 15, 2029, less than 47 days.\n\n> From today until March 15, 2027, the maximum lifetime for a public TLS certificate issued will be 198 days. This is a reduction from the previous lifetime of 395 days.\n\nSource: \n", "ca_name": "Amazon Trust Services (ACM)", "file": "amazon-trust-services-acm.md", "generated": true, "harvested": "2026-08-18", "id": "amazon-trust-services-acm", "max_validity_days": "198", "next_reduction_date": "2027-03-15", "notes": "A reduction from the previous lifetime of 395 days. As of March 15, 2027, the maximum lifetime will be less than 100 days; as of March 15, 2029, less than 47 days.", "profile": "ACM-issued public", "source_quote": "From today until March 15, 2027, the maximum lifetime for a public TLS certificate issued will be 198 days. This is a reduction from the previous lifetime of 395 days.", "sources": ["https://aws.amazon.com/certificate-manager/faqs/"], "stale_after": "2026-09-17", "still_active": "yes", "title": "Amazon Trust Services (ACM) \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "unverified_fields": "ca_name", "verified": false} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** Buypass\n\n**Still issuing TLS certificates:** no\n\n**Notes:** Last day to order, renew, or replace: 15.10.2025; last day for issuance: 31.10.2025. Existing TLS/SSL certificates remain valid until expiry; revocation and certificate status services run until 31.10.2026 (TLS/SSL) and 31.10.2027 (PSD2).\n\n> August 18th 2025: As of 15 October 2025, Buypass will no longer offer TLS/SSL certificates. The decision is based on a comprehensive assessment of the market situation and the regulatory framework for issuing TLS/SSL certificates.\n\nSource: \n", "ca_name": "Buypass", "file": "buypass.md", "generated": true, "harvested": "2026-08-18", "id": "buypass", "notes": "Last day to order, renew, or replace: 15.10.2025; last day for issuance: 31.10.2025. Existing TLS/SSL certificates remain valid until expiry; revocation and certificate status services run until 31.10.2026 (TLS/SSL) and 31.10.2027 (PSD2).", "source_quote": "August 18th 2025: As of 15 October 2025, Buypass will no longer offer TLS/SSL certificates. The decision is based on a comprehensive assessment of the market situation and the regulatory framework for issuing TLS/SSL certificates.", "sources": ["https://www.buypass.com/products/tls-ssl-certificates/discontinues-issuance-of-tls-ssl-certificates"], "stale_after": "2026-09-17", "still_active": "no", "title": "Buypass \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** DigiCert\n\n**Maximum validity (days):** 199\n\n**Effective date of current limit:** 2026-02-24\n\n**Next reduction limit (days):** 99\n\n**Still issuing TLS certificates:** yes\n\n**Notes:** DigiCert's maxima are one day shorter than the CA/Browser Forum ceiling; the 99-day maximum applies between early 2027 and early 2029, with a 46-day maximum from early 2029.\n\n> Additionally, all public TLS certificates issued on or after February 24, 2026, cannot exceed the new 199-day maximum validity.\n\nSource: \n", "ca_name": "DigiCert", "effective_since": "2026-02-24", "file": "digicert.md", "generated": true, "harvested": "2026-08-18", "id": "digicert", "max_validity_days": "199", "next_reduction_days": "99", "notes": "DigiCert's maxima are one day shorter than the CA/Browser Forum ceiling; the 99-day maximum applies between early 2027 and early 2029, with a 46-day maximum from early 2029.", "source_quote": "Additionally, all public TLS certificates issued on or after February 24, 2026, cannot exceed the new 199-day maximum validity.", "sources": ["https://knowledge.digicert.com/alerts/public-tls-certificates-199-day-validity"], "stale_after": "2026-09-17", "still_active": "yes", "title": "DigiCert \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "unverified_fields": "notes", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** Entrust\n\n**Still issuing TLS certificates:** no\n\n**Notes:** Entrust sold its public certificate business to Sectigo (announced January 29, 2025); former Entrust public certificate customers are now Sectigo customers and Entrust no longer issues publicly-trusted TLS certificates.\n\n> today announced the purchase of Entrust\u2019s public certificate business, marking a transformative milestone in the company\u2019s history\n\nSource: \n", "ca_name": "Entrust", "file": "entrust.md", "generated": true, "harvested": "2026-08-18", "id": "entrust", "notes": "Entrust sold its public certificate business to Sectigo (announced January 29, 2025); former Entrust public certificate customers are now Sectigo customers and Entrust no longer issues publicly-trusted TLS certificates.", "source_quote": "today announced the purchase of Entrust\u2019s public certificate business, marking a transformative milestone in the company\u2019s history", "sources": ["https://www.sectigo.com/resource-library/sectigo-acquires-entrust-public-certificate-business"], "stale_after": "2026-09-17", "still_active": "no", "title": "Entrust \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "unverified_fields": "still_active", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** GlobalSign\n\n**Profile or Product:** DomainSSL\n\n**Maximum validity (days):** 199\n\n**Still issuing TLS certificates:** yes\n\n> DomainSSL | 199 Days |\n\nSource: \n", "ca_name": "GlobalSign", "file": "globalsign-2.md", "generated": true, "harvested": "2026-08-18", "id": "globalsign-2", "max_validity_days": "199", "profile": "DomainSSL", "source_quote": "DomainSSL | 199 Days |", "sources": ["https://support.globalsign.com/ssl/general-information/maximum-certificate-validity"], "stale_after": "2026-09-17", "still_active": "yes", "title": "GlobalSign \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "unverified_fields": "still_active", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** GlobalSign\n\n**Profile or Product:** ExtendedSSL\n\n**Maximum validity (days):** 199\n\n**Still issuing TLS certificates:** yes\n\n> ExtendedSSL | 199 Days |\n\nSource: \n", "ca_name": "GlobalSign", "file": "globalsign-3.md", "generated": true, "harvested": "2026-08-18", "id": "globalsign-3", "max_validity_days": "199", "profile": "ExtendedSSL", "source_quote": "ExtendedSSL | 199 Days |", "sources": ["https://support.globalsign.com/ssl/general-information/maximum-certificate-validity"], "stale_after": "2026-09-17", "still_active": "yes", "title": "GlobalSign \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "unverified_fields": "still_active", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** GlobalSign\n\n**Profile or Product:** OrganizationSSL\n\n**Maximum validity (days):** 199\n\n**Still issuing TLS certificates:** yes\n\n> OrganizationSSL | 199 Days |\n\nSource: \n", "ca_name": "GlobalSign", "file": "globalsign-4.md", "generated": true, "harvested": "2026-08-18", "id": "globalsign-4", "max_validity_days": "199", "profile": "OrganizationSSL", "source_quote": "OrganizationSSL | 199 Days |", "sources": ["https://support.globalsign.com/ssl/general-information/maximum-certificate-validity"], "stale_after": "2026-09-17", "still_active": "yes", "title": "GlobalSign \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "unverified_fields": "still_active", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** GlobalSign\n\n**Profile or Product:** CloudSSL\n\n**Maximum validity (days):** 199\n\n**Still issuing TLS certificates:** yes\n\n**Notes:** Effective March 15, 2026, certificates issued on or after this date are limited by the CA/B Forum Baseline Requirements to a maximum validity of 200 days; GlobalSign's product table lists 199 days for all TLS products.\n\n> CloudSSL | 199 Days |\n\nSource: \n", "ca_name": "GlobalSign", "file": "globalsign-5.md", "generated": true, "harvested": "2026-08-18", "id": "globalsign-5", "max_validity_days": "199", "notes": "Effective March 15, 2026, certificates issued on or after this date are limited by the CA/B Forum Baseline Requirements to a maximum validity of 200 days; GlobalSign's product table lists 199 days for all TLS products.", "profile": "CloudSSL", "source_quote": "CloudSSL | 199 Days |", "sources": ["https://support.globalsign.com/ssl/general-information/maximum-certificate-validity"], "stale_after": "2026-09-17", "still_active": "yes", "title": "GlobalSign \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "unverified_fields": "still_active", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** GlobalSign\n\n**Profile or Product:** AlphaSSL\n\n**Maximum validity (days):** 199\n\n**Still issuing TLS certificates:** yes\n\n> Product | Maximum Validity | AlphaSSL | 199 Days |\n\nSource: \n", "ca_name": "GlobalSign", "file": "globalsign.md", "generated": true, "harvested": "2026-08-18", "id": "globalsign", "max_validity_days": "199", "profile": "AlphaSSL", "source_quote": "Product | Maximum Validity | AlphaSSL | 199 Days |", "sources": ["https://support.globalsign.com/ssl/general-information/maximum-certificate-validity"], "stale_after": "2026-09-17", "still_active": "yes", "title": "GlobalSign \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "unverified_fields": "still_active", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** GoDaddy\n\n**Profile or Product:** Managed SSL 90-Day\n\n**Maximum validity (days):** 90\n\n**Still issuing TLS certificates:** yes\n\n**Notes:** 90-day certificates are available to customers with GoDaddy Websites + Marketing, Managed Hosting for WordPress, or Paylinks plans and Managed SSL subscriptions; the page states Self-Managed or Do-It-Yourself SSL certificates 'will continue with yearly validation', but the page predates the 2026 industry reduction and states no current maximum for self-managed products.\n\n> 90-Day SSL certificates are certificates that automatically reprovision every 90 days instead of the current 1-year standard.\n\nSource: \n", "ca_name": "GoDaddy", "file": "godaddy.md", "generated": true, "harvested": "2026-08-18", "id": "godaddy", "max_validity_days": "90", "notes": "90-day certificates are available to customers with GoDaddy Websites + Marketing, Managed Hosting for WordPress, or Paylinks plans and Managed SSL subscriptions; the page states Self-Managed or Do-It-Yourself SSL certificates 'will continue with yearly validation', but the page predates the 2026 industry reduction and states no current maximum for self-managed products.", "profile": "Managed SSL 90-Day", "source_quote": "90-Day SSL certificates are certificates that automatically reprovision every 90 days instead of the current 1-year standard.", "sources": ["https://www.godaddy.com/help/all-about-90-day-ssl-certificates-42440"], "stale_after": "2026-09-17", "still_active": "yes", "title": "GoDaddy \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** Google Trust Services\n\n**Profile or Product:** SXG subscriber\n\n**Maximum validity (days):** 48\n\n**Still issuing TLS certificates:** yes\n\n**Notes:** Signed Exchange (SXG) subscriber certificates, per TLS CP/CPS section 6.3.2.\n\n> SXG subscriber certificates are issued for a period of 48 days or less.\n\nSource: \n", "ca_name": "Google Trust Services", "file": "google-trust-services-2.md", "generated": true, "harvested": "2026-08-18", "id": "google-trust-services-2", "max_validity_days": "48", "notes": "Signed Exchange (SXG) subscriber certificates, per TLS CP/CPS section 6.3.2.", "profile": "SXG subscriber", "source_quote": "SXG subscriber certificates are issued for a period of 48 days or less.", "sources": ["https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html"], "stale_after": "2026-09-17", "still_active": "yes", "title": "Google Trust Services \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "unverified_fields": "still_active", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** Google Trust Services\n\n**Maximum validity (days):** 93\n\n**Still issuing TLS certificates:** yes\n\n**Notes:** Per TLS CP/CPS section 6.3.2. SXG subscriber certificates are issued for a period of 48 days or less. A day is measured as 86,400 seconds.\n\n> Leaf Certificates are issued for a period of 93 days or less. SXG subscriber certificates are issued for a period of 48 days or less. A day is measured as 86,400 seconds.\n\nSource: \n", "ca_name": "Google Trust Services", "file": "google-trust-services.md", "generated": true, "harvested": "2026-08-18", "id": "google-trust-services", "max_validity_days": "93", "notes": "Per TLS CP/CPS section 6.3.2. SXG subscriber certificates are issued for a period of 48 days or less. A day is measured as 86,400 seconds.", "source_quote": "Leaf Certificates are issued for a period of 93 days or less. SXG subscriber certificates are issued for a period of 48 days or less. A day is measured as 86,400 seconds.", "sources": ["https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html"], "stale_after": "2026-09-17", "still_active": "yes", "title": "Google Trust Services \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "unverified_fields": "still_active", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** HARICA\n\n**Maximum validity (days):** 199\n\n**Effective date of current limit:** 2026-03-13\n\n**Still issuing TLS certificates:** yes\n\n**Notes:** Reduction from 365 days (previously issued at up to 397 days maximum). Implemented gradually 9-13 March 2026; after 13 March all newly issued Server Certificates carry the 199-day maximum. Source is a RedIRIS (HARICA reseller partner) page reproducing HARICA's subscriber announcement verbatim; HARICA published no directly linkable page.\n\n> After 13 March : All newly issued Server Certificates will be issued with the new maximum validity period of 199 days.\n\nSource: \n", "ca_name": "HARICA", "effective_since": "2026-03-13", "file": "harica.md", "generated": true, "harvested": "2026-08-18", "id": "harica", "max_validity_days": "199", "notes": "Reduction from 365 days (previously issued at up to 397 days maximum). Implemented gradually 9-13 March 2026; after 13 March all newly issued Server Certificates carry the 199-day maximum. Source is a RedIRIS (HARICA reseller partner) page reproducing HARICA's subscriber announcement verbatim; HARICA published no directly linkable page.", "source_quote": "After 13 March : All newly issued Server Certificates will be issued with the new maximum validity period of 199 days.", "sources": ["https://www.rediris.es/tcs/news/2026/20260304-reduccion_199_dias.html"], "stale_after": "2026-09-17", "still_active": "yes", "title": "HARICA \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** IdenTrust\n\n**Maximum validity (days):** 200\n\n**Still issuing TLS certificates:** yes\n\n**Notes:** Under the new policy, initial certificate issuance covers a period of 184 days (approximately six months), followed by a 15-day renewal window. The change was published 11/13/2025 and takes effect March 10, 2026.\n\n> Effective March 10, 2026, IdenTrust will reduce the maximum validity period of the TLS certificates we issue to 200 days, in alignment with CA/Browser Forum Baseline Requirements to maintain global browser trust.\n\nSource: \n", "ca_name": "IdenTrust", "file": "identrust.md", "generated": true, "harvested": "2026-08-18", "id": "identrust", "max_validity_days": "200", "notes": "Under the new policy, initial certificate issuance covers a period of 184 days (approximately six months), followed by a 15-day renewal window. The change was published 11/13/2025 and takes effect March 10, 2026.", "source_quote": "Effective March 10, 2026, IdenTrust will reduce the maximum validity period of the TLS certificates we issue to 200 days, in alignment with CA/Browser Forum Baseline Requirements to maintain global browser trust.", "sources": ["https://www.identrust.com/support/announcements"], "stale_after": "2026-09-17", "still_active": "yes", "title": "IdenTrust \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** Let's Encrypt\n\n**Profile or Product:** shortlived\n\n**Maximum validity (days):** 6\n\n**Still issuing TLS certificates:** yes\n\n**Notes:** Validity Period is stated as 160 hours in the profile table; qualifies as a Short-Lived Subscriber Certificate under the Baseline Requirements and needs no revocation information.\n\n> The shortlived profile is identical to the tlsserver profile, with one key distinction: the resulting certificate is only valid for 6ish days.\n\nSource: \n", "ca_name": "Let's Encrypt", "file": "let-s-encrypt-2.md", "generated": true, "harvested": "2026-08-18", "id": "let-s-encrypt-2", "max_validity_days": "6", "notes": "Validity Period is stated as 160 hours in the profile table; qualifies as a Short-Lived Subscriber Certificate under the Baseline Requirements and needs no revocation information.", "profile": "shortlived", "source_quote": "The shortlived profile is identical to the tlsserver profile, with one key distinction: the resulting certificate is only valid for 6ish days.", "sources": ["https://letsencrypt.org/docs/profiles/"], "stale_after": "2026-09-17", "still_active": "yes", "title": "Let's Encrypt \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "unverified_fields": "max_validity_days", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** Let's Encrypt\n\n**Profile or Product:** classic\n\n**Maximum validity (days):** 90\n\n**Still issuing TLS certificates:** yes\n\n**Notes:** The FAQ states the default lifetime; the profiles documentation names the default profile 'classic'. Let's Encrypt recommends renewing 90 day certificates every 60 days. There is no way to adjust these lifetimes.\n\n> Our default certificates are valid for 90 days.\n\nSource: \n", "ca_name": "Let's Encrypt", "file": "let-s-encrypt-3.md", "generated": true, "harvested": "2026-08-18", "id": "let-s-encrypt-3", "max_validity_days": "90", "notes": "The FAQ states the default lifetime; the profiles documentation names the default profile 'classic'. Let's Encrypt recommends renewing 90 day certificates every 60 days. There is no way to adjust these lifetimes.", "profile": "classic", "source_quote": "Our default certificates are valid for 90 days.", "sources": ["https://letsencrypt.org/docs/faq/"], "stale_after": "2026-09-17", "still_active": "yes", "title": "Let's Encrypt \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "unverified_fields": "profile, still_active", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** Let's Encrypt\n\n**Profile or Product:** tlsserver\n\n**Maximum validity (days):** 45\n\n**Still issuing TLS certificates:** yes\n\n**Notes:** Valid for only 45 days, in preparation for upcoming restrictions that will limit all certificates to at most 47 days.\n\n> And finally the resulting certificate is valid for only 45 days, in preparation for upcoming restrictions that will limit all certificates to at most 47 days.\n\nSource: \n", "ca_name": "Let's Encrypt", "file": "let-s-encrypt.md", "generated": true, "harvested": "2026-08-18", "id": "let-s-encrypt", "max_validity_days": "45", "notes": "Valid for only 45 days, in preparation for upcoming restrictions that will limit all certificates to at most 47 days.", "profile": "tlsserver", "source_quote": "And finally the resulting certificate is valid for only 45 days, in preparation for upcoming restrictions that will limit all certificates to at most 47 days.", "sources": ["https://letsencrypt.org/docs/profiles/"], "stale_after": "2026-09-17", "still_active": "yes", "title": "Let's Encrypt \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "unverified_fields": "profile", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** Sectigo\n\n**Maximum validity (days):** 199\n\n**Still issuing TLS certificates:** yes\n\n**Notes:** 199 days is described as 6 months plus extra time to renew. Domain Control Validation reuse is limited to 198 days from the same date. Sectigo acquired Entrust's public certificate business (completed September 18, 2025).\n\n> To align with evolving industry requirements, Sectigo will begin enforcing a maximum TLS certificate validity of 199 days starting March 12, 2026.\n\nSource: \n", "ca_name": "Sectigo", "file": "sectigo.md", "generated": true, "harvested": "2026-08-18", "id": "sectigo", "max_validity_days": "199", "notes": "199 days is described as 6 months plus extra time to renew. Domain Control Validation reuse is limited to 198 days from the same date. Sectigo acquired Entrust's public certificate business (completed September 18, 2025).", "source_quote": "To align with evolving industry requirements, Sectigo will begin enforcing a maximum TLS certificate validity of 199 days starting March 12, 2026.", "sources": ["https://www.sectigo.com/resource-library/shorter-validity-periods-for-tls-certificates-and-dcv"], "stale_after": "2026-09-17", "still_active": "yes", "title": "Sectigo \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** SSL.com\n\n**Maximum validity (days):** 198\n\n**Still issuing TLS certificates:** yes\n\n**Notes:** SSL.com issues 198 days, or the remaining duration of the certificate order, whichever is shorter; previously issued for 396 days. A purchase still represents a 12-month license period fulfilled through reissued 198-day certificates. The change took effect March 11, 2026.\n\n> To comply with the new requirement, SSL now issues certificates for 198 days, or the remaining duration of the certificate order, whichever is shorter.\n\nSource: \n", "ca_name": "SSL.com", "file": "ssl-com.md", "generated": true, "harvested": "2026-08-18", "id": "ssl-com", "max_validity_days": "198", "notes": "SSL.com issues 198 days, or the remaining duration of the certificate order, whichever is shorter; previously issued for 396 days. A purchase still represents a 12-month license period fulfilled through reissued 198-day certificates. The change took effect March 11, 2026.", "source_quote": "To comply with the new requirement, SSL now issues certificates for 198 days, or the remaining duration of the certificate order, whichever is shorter.", "sources": ["https://www.ssl.com/blog/ssl-certificate-validity/"], "stale_after": "2026-09-17", "still_active": "yes", "title": "SSL.com \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** ZeroSSL\n\n**Profile or Product:** ACME/free\n\n**Maximum validity (days):** 90\n\n**Still issuing TLS certificates:** yes\n\n**Notes:** Free ACME-issued certificates are 90 days, renewable automatically with any major ACME client.\n\n> ACME integrations let you order and renew 90-day certificates automatically and free of charge, using any major ACME client:\n\nSource: \n", "ca_name": "ZeroSSL", "file": "zerossl-2.md", "generated": true, "harvested": "2026-08-18", "id": "zerossl-2", "max_validity_days": "90", "notes": "Free ACME-issued certificates are 90 days, renewable automatically with any major ACME client.", "profile": "ACME/free", "source_quote": "ACME integrations let you order and renew 90-day certificates automatically and free of charge, using any major ACME client:", "sources": ["https://zerossl.com/features/acme/"], "stale_after": "2026-09-17", "still_active": "yes", "title": "ZeroSSL \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "verified": true} {"asset": "ca-issuance-validity", "body": "**Certificate Authority:** ZeroSSL\n\n**Profile or Product:** Annual\n\n**Maximum validity (days):** 200\n\n**Effective date of current limit:** 2026-03-15\n\n**Still issuing TLS certificates:** yes\n\n**Notes:** Annual certificates provide one year of coverage through multiple certificate issuances; every new certificate follows the 200-day limit and requires a mid-term reissuance to cover the full 1-year period. ZeroSSL no longer offers single 1-year certificate issuances.\n\n> Starting March 15, 2026, SSL/TLS certificates can be issued for a maximum of 200 days . This reflects a shift from the previous 1\u2011year validity model to a shorter, more secure lifecycle.\n\nSource: \n", "ca_name": "ZeroSSL", "effective_since": "2026-03-15", "file": "zerossl.md", "generated": true, "harvested": "2026-08-18", "id": "zerossl", "max_validity_days": "200", "notes": "Annual certificates provide one year of coverage through multiple certificate issuances; every new certificate follows the 200-day limit and requires a mid-term reissuance to cover the full 1-year period. ZeroSSL no longer offers single 1-year certificate issuances.", "profile": "Annual", "source_quote": "Starting March 15, 2026, SSL/TLS certificates can be issued for a maximum of 200 days . This reflects a shift from the previous 1\u2011year validity model to a shorter, more secure lifecycle.", "sources": ["https://help.zerossl.com/hc/en-us/articles/34330849350173-SSL-TLS-Certificate-Validity-Changes-New-200-Day-Limit-Explained"], "stale_after": "2026-09-17", "still_active": "yes", "title": "ZeroSSL \u2014 TLS certificate maximum validity by Certificate Authority: what each CA actually issues today", "type": "validity-period", "unverified_fields": "profile", "verified": true}