{
  "name": "TLS certificate maximum validity by Certificate Authority: what each CA actually issues today",
  "description": "Per-CA table of the maximum TLS certificate validity period each publicly-trusted Certificate Authority actually issues today, with the date the current limit took effect and any announced future reductions. Many CAs issue below the CA/Browser Forum BR ceiling (currently 200 days since March 15, 2026): DigiCert cut to 199 days from February 24, 2026 (three weeks early); Let's Encrypt issues 90 days on its classic profile, 45 days on its tlsserver profile, and 6 days on its shortlived profile; Google Trust Services issues at most 93 days by CP/CPS v6.2; Amazon ACM issues 198 days; Actalis issues 184 days. Entrust sold its public certificate business to Sectigo in January 2025 (completed September 18, 2025) and no longer issues publicly-trusted TLS certificates. Buypass stopped issuing TLS certificates on October 31, 2025. No single page anywhere publishes this side-by-side; the data layer under any CA-aware planner or renewal tool must be assembled from each CA's own announcements. Answers 'what is the maximum TLS certificate validity for Let's Encrypt?', 'how long does DigiCert issue certificates?', 'which CA issues shorter certificates than the BR maximum?', 'does Google Trust Services issue 200-day certificates?', 'what CA is issuing 90-day certificates now?', and 'what happened to Entrust TLS certificates?'",
  "url": "https://referencesource.org/ca-issuance-validity/",
  "licence": "Facts extracted from each CA's own publicly-published documentation, announcements, and certification practice statements. Certificate validity limits are regulatory facts, not creative expression. Each record quotes a short verbatim span and links to the CA's own page.",
  "last_verified": "2026-08-18",
  "stale_after": "2026-09-17",
  "sources": [
    "https://guide.actalis.com/faq/Certificate-Validity/Certificate-Validity",
    "https://aws.amazon.com/certificate-manager/faqs/",
    "https://www.buypass.com/products/tls-ssl-certificates/discontinues-issuance-of-tls-ssl-certificates",
    "https://knowledge.digicert.com/alerts/public-tls-certificates-199-day-validity",
    "https://www.sectigo.com/resource-library/sectigo-acquires-entrust-public-certificate-business",
    "https://support.globalsign.com/ssl/general-information/maximum-certificate-validity",
    "https://www.godaddy.com/help/all-about-90-day-ssl-certificates-42440",
    "https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html",
    "https://www.rediris.es/tcs/news/2026/20260304-reduccion_199_dias.html",
    "https://www.identrust.com/support/announcements",
    "https://letsencrypt.org/docs/profiles/",
    "https://letsencrypt.org/docs/faq/",
    "https://www.sectigo.com/resource-library/shorter-validity-periods-for-tls-certificates-and-dcv",
    "https://www.ssl.com/blog/ssl-certificate-validity/",
    "https://zerossl.com/features/acme/",
    "https://help.zerossl.com/hc/en-us/articles/34330849350173-SSL-TLS-Certificate-Validity-Changes-New-200-Day-Limit-Explained"
  ],
  "records": [
    {
      "ca_name": "Actalis",
      "max_validity_days": "184",
      "still_active": "yes",
      "notes": "Certificates show a duration of 6 months; annual coverage is guaranteed through a second certificate available in the customer area after 168 days, with a 16-day activation window between the 169th and 184th day. A renewal certificate issued within 184 days carries 184 days plus the remaining period of the previous certificate (e.g. 200 days total if issued on day 169). Certificates issued before March 15, 2026 retain their original duration.",
      "id": "actalis",
      "url": "https://referencesource.org/ca-issuance-validity/actalis/",
      "source": "https://guide.actalis.com/faq/Certificate-Validity/Certificate-Validity",
      "source_quote": "Yes. If renewal occurs within 184 days, a renewal certificate is issued with a duration equal to 184 days plus the remaining period of the previous certificate.",
      "verified_fields": [
        "ca_name",
        "max_validity_days"
      ],
      "derived_fields": [
        "notes",
        "still_active"
      ]
    },
    {
      "ca_name": "Amazon Trust Services (ACM)",
      "profile": "ACM-issued public",
      "max_validity_days": "198",
      "next_reduction_date": "2027-03-15",
      "still_active": "yes",
      "notes": "A reduction from the previous lifetime of 395 days. As of March 15, 2027, the maximum lifetime will be less than 100 days; as of March 15, 2029, less than 47 days.",
      "id": "amazon-trust-services-acm",
      "url": "https://referencesource.org/ca-issuance-validity/amazon-trust-services-acm/",
      "source": "https://aws.amazon.com/certificate-manager/faqs/",
      "source_quote": "From today until March 15, 2027, the maximum lifetime for a public TLS certificate issued will be 198 days. This is a reduction from the previous lifetime of 395 days.",
      "verified_fields": [
        "max_validity_days"
      ],
      "derived_fields": [
        "next_reduction_date",
        "notes",
        "profile",
        "still_active"
      ]
    },
    {
      "ca_name": "Buypass",
      "still_active": "no",
      "notes": "Last day to order, renew, or replace: 15.10.2025; last day for issuance: 31.10.2025. Existing TLS/SSL certificates remain valid until expiry; revocation and certificate status services run until 31.10.2026 (TLS/SSL) and 31.10.2027 (PSD2).",
      "id": "buypass",
      "url": "https://referencesource.org/ca-issuance-validity/buypass/",
      "source": "https://www.buypass.com/products/tls-ssl-certificates/discontinues-issuance-of-tls-ssl-certificates",
      "source_quote": "August 18th 2025: As of 15 October 2025, Buypass will no longer offer TLS/SSL certificates. The decision is based on a comprehensive assessment of the market situation and the regulatory framework for issuing TLS/SSL certificates.",
      "verified_fields": [
        "ca_name"
      ],
      "derived_fields": [
        "notes",
        "still_active"
      ]
    },
    {
      "ca_name": "DigiCert",
      "max_validity_days": "199",
      "effective_since": "2026-02-24",
      "next_reduction_days": "99",
      "still_active": "yes",
      "notes": "DigiCert's maxima are one day shorter than the CA/Browser Forum ceiling; the 99-day maximum applies between early 2027 and early 2029, with a 46-day maximum from early 2029.",
      "id": "digicert",
      "url": "https://referencesource.org/ca-issuance-validity/digicert/",
      "source": "https://knowledge.digicert.com/alerts/public-tls-certificates-199-day-validity",
      "source_quote": "Additionally, all public TLS certificates issued on or after February 24, 2026, cannot exceed the new 199-day maximum validity.",
      "verified_fields": [
        "ca_name",
        "max_validity_days",
        "next_reduction_days"
      ],
      "derived_fields": [
        "effective_since",
        "notes",
        "still_active"
      ]
    },
    {
      "ca_name": "Entrust",
      "still_active": "no",
      "notes": "Entrust sold its public certificate business to Sectigo (announced January 29, 2025); former Entrust public certificate customers are now Sectigo customers and Entrust no longer issues publicly-trusted TLS certificates.",
      "id": "entrust",
      "url": "https://referencesource.org/ca-issuance-validity/entrust/",
      "source": "https://www.sectigo.com/resource-library/sectigo-acquires-entrust-public-certificate-business",
      "source_quote": "today announced the purchase of Entrust\u2019s public certificate business, marking a transformative milestone in the company\u2019s history",
      "verified_fields": [
        "ca_name"
      ],
      "derived_fields": [
        "notes",
        "still_active"
      ]
    },
    {
      "ca_name": "GlobalSign",
      "profile": "AlphaSSL",
      "max_validity_days": "199",
      "still_active": "yes",
      "id": "globalsign",
      "url": "https://referencesource.org/ca-issuance-validity/globalsign/",
      "source": "https://support.globalsign.com/ssl/general-information/maximum-certificate-validity",
      "source_quote": "Product | Maximum Validity | AlphaSSL | 199 Days |",
      "verified_fields": [
        "ca_name",
        "max_validity_days"
      ],
      "derived_fields": [
        "profile",
        "still_active"
      ],
      "also_reported": [
        {
          "field": "notes",
          "value": "Effective March 15, 2026, certificates issued on or after this date are limited by the CA/B Forum Baseline Requirements to a maximum validity of 200 days; GlobalSign's product table lists 199 days for all TLS products.",
          "source": "https://support.globalsign.com/ssl/general-information/maximum-certificate-validity",
          "source_quote": "CloudSSL | 199 Days |",
          "as_of": "2026-08-18"
        }
      ],
      "disagreements": [
        {
          "field": "profile",
          "versions": [
            {
              "value": "AlphaSSL",
              "source": "https://support.globalsign.com/ssl/general-information/maximum-certificate-validity",
              "source_quote": "Product | Maximum Validity | AlphaSSL | 199 Days |",
              "as_of": "2026-08-18"
            },
            {
              "value": "DomainSSL",
              "source": "https://support.globalsign.com/ssl/general-information/maximum-certificate-validity",
              "source_quote": "DomainSSL | 199 Days |",
              "as_of": "2026-08-18"
            },
            {
              "value": "ExtendedSSL",
              "source": "https://support.globalsign.com/ssl/general-information/maximum-certificate-validity",
              "source_quote": "ExtendedSSL | 199 Days |",
              "as_of": "2026-08-18"
            },
            {
              "value": "OrganizationSSL",
              "source": "https://support.globalsign.com/ssl/general-information/maximum-certificate-validity",
              "source_quote": "OrganizationSSL | 199 Days |",
              "as_of": "2026-08-18"
            },
            {
              "value": "CloudSSL",
              "source": "https://support.globalsign.com/ssl/general-information/maximum-certificate-validity",
              "source_quote": "CloudSSL | 199 Days |",
              "as_of": "2026-08-18"
            }
          ]
        }
      ]
    },
    {
      "ca_name": "GoDaddy",
      "profile": "Managed SSL 90-Day",
      "max_validity_days": "90",
      "still_active": "yes",
      "notes": "90-day certificates are available to customers with GoDaddy Websites + Marketing, Managed Hosting for WordPress, or Paylinks plans and Managed SSL subscriptions; the page states Self-Managed or Do-It-Yourself SSL certificates 'will continue with yearly validation', but the page predates the 2026 industry reduction and states no current maximum for self-managed products.",
      "id": "godaddy",
      "url": "https://referencesource.org/ca-issuance-validity/godaddy/",
      "source": "https://www.godaddy.com/help/all-about-90-day-ssl-certificates-42440",
      "source_quote": "90-Day SSL certificates are certificates that automatically reprovision every 90 days instead of the current 1-year standard.",
      "verified_fields": [
        "ca_name",
        "max_validity_days"
      ],
      "derived_fields": [
        "notes",
        "profile",
        "still_active"
      ]
    },
    {
      "ca_name": "Google Trust Services",
      "max_validity_days": "93",
      "still_active": "yes",
      "notes": "Per TLS CP/CPS section 6.3.2. SXG subscriber certificates are issued for a period of 48 days or less. A day is measured as 86,400 seconds.",
      "id": "google-trust-services",
      "url": "https://referencesource.org/ca-issuance-validity/google-trust-services/",
      "source": "https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html",
      "source_quote": "Leaf Certificates are issued for a period of 93 days or less. SXG subscriber certificates are issued for a period of 48 days or less. A day is measured as 86,400 seconds.",
      "verified_fields": [
        "ca_name",
        "max_validity_days"
      ],
      "derived_fields": [
        "notes",
        "still_active"
      ],
      "also_reported": [
        {
          "field": "profile",
          "value": "SXG subscriber",
          "source": "https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html",
          "source_quote": "SXG subscriber certificates are issued for a period of 48 days or less.",
          "as_of": "2026-08-18"
        }
      ],
      "disagreements": [
        {
          "field": "max_validity_days",
          "versions": [
            {
              "value": "93",
              "source": "https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html",
              "source_quote": "Leaf Certificates are issued for a period of 93 days or less. SXG subscriber certificates are issued for a period of 48 days or less. A day is measured as 86,400 seconds.",
              "as_of": "2026-08-18"
            },
            {
              "value": "48",
              "source": "https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html",
              "source_quote": "SXG subscriber certificates are issued for a period of 48 days or less.",
              "as_of": "2026-08-18"
            }
          ]
        },
        {
          "field": "notes",
          "versions": [
            {
              "value": "Per TLS CP/CPS section 6.3.2. SXG subscriber certificates are issued for a period of 48 days or less. A day is measured as 86,400 seconds.",
              "source": "https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html",
              "source_quote": "Leaf Certificates are issued for a period of 93 days or less. SXG subscriber certificates are issued for a period of 48 days or less. A day is measured as 86,400 seconds.",
              "as_of": "2026-08-18"
            },
            {
              "value": "Signed Exchange (SXG) subscriber certificates, per TLS CP/CPS section 6.3.2.",
              "source": "https://pki.goog/repo/cp-cps-tls/6.2/GTS-CP-CPS-TLS.html",
              "source_quote": "SXG subscriber certificates are issued for a period of 48 days or less.",
              "as_of": "2026-08-18"
            }
          ]
        }
      ]
    },
    {
      "ca_name": "HARICA",
      "max_validity_days": "199",
      "effective_since": "2026-03-13",
      "still_active": "yes",
      "notes": "Reduction from 365 days (previously issued at up to 397 days maximum). Implemented gradually 9-13 March 2026; after 13 March all newly issued Server Certificates carry the 199-day maximum. Source is a RedIRIS (HARICA reseller partner) page reproducing HARICA's subscriber announcement verbatim; HARICA published no directly linkable page.",
      "id": "harica",
      "url": "https://referencesource.org/ca-issuance-validity/harica/",
      "source": "https://www.rediris.es/tcs/news/2026/20260304-reduccion_199_dias.html",
      "source_quote": "After 13 March : All newly issued Server Certificates will be issued with the new maximum validity period of 199 days.",
      "verified_fields": [
        "ca_name",
        "max_validity_days"
      ],
      "derived_fields": [
        "effective_since",
        "notes",
        "still_active"
      ]
    },
    {
      "ca_name": "IdenTrust",
      "max_validity_days": "200",
      "still_active": "yes",
      "notes": "Under the new policy, initial certificate issuance covers a period of 184 days (approximately six months), followed by a 15-day renewal window. The change was published 11/13/2025 and takes effect March 10, 2026.",
      "id": "identrust",
      "url": "https://referencesource.org/ca-issuance-validity/identrust/",
      "source": "https://www.identrust.com/support/announcements",
      "source_quote": "Effective March 10, 2026, IdenTrust will reduce the maximum validity period of the TLS certificates we issue to 200 days, in alignment with CA/Browser Forum Baseline Requirements to maintain global browser trust.",
      "verified_fields": [
        "ca_name",
        "max_validity_days"
      ],
      "derived_fields": [
        "notes",
        "still_active"
      ]
    },
    {
      "ca_name": "Let's Encrypt",
      "profile": "tlsserver",
      "max_validity_days": "45",
      "still_active": "yes",
      "notes": "Valid for only 45 days, in preparation for upcoming restrictions that will limit all certificates to at most 47 days.",
      "id": "let-s-encrypt",
      "url": "https://referencesource.org/ca-issuance-validity/let-s-encrypt/",
      "source": "https://letsencrypt.org/docs/profiles/",
      "source_quote": "And finally the resulting certificate is valid for only 45 days, in preparation for upcoming restrictions that will limit all certificates to at most 47 days.",
      "verified_fields": [
        "ca_name",
        "max_validity_days"
      ],
      "derived_fields": [
        "notes",
        "profile",
        "still_active"
      ],
      "disagreements": [
        {
          "field": "profile",
          "versions": [
            {
              "value": "tlsserver",
              "source": "https://letsencrypt.org/docs/profiles/",
              "source_quote": "And finally the resulting certificate is valid for only 45 days, in preparation for upcoming restrictions that will limit all certificates to at most 47 days.",
              "as_of": "2026-08-18"
            },
            {
              "value": "shortlived",
              "source": "https://letsencrypt.org/docs/profiles/",
              "source_quote": "The shortlived profile is identical to the tlsserver profile, with one key distinction: the resulting certificate is only valid for 6ish days.",
              "as_of": "2026-08-18"
            },
            {
              "value": "classic",
              "source": "https://letsencrypt.org/docs/faq/",
              "source_quote": "Our default certificates are valid for 90 days.",
              "as_of": "2026-08-18"
            }
          ]
        },
        {
          "field": "max_validity_days",
          "versions": [
            {
              "value": "45",
              "source": "https://letsencrypt.org/docs/profiles/",
              "source_quote": "And finally the resulting certificate is valid for only 45 days, in preparation for upcoming restrictions that will limit all certificates to at most 47 days.",
              "as_of": "2026-08-18"
            },
            {
              "value": "6",
              "source": "https://letsencrypt.org/docs/profiles/",
              "source_quote": "The shortlived profile is identical to the tlsserver profile, with one key distinction: the resulting certificate is only valid for 6ish days.",
              "as_of": "2026-08-18"
            },
            {
              "value": "90",
              "source": "https://letsencrypt.org/docs/faq/",
              "source_quote": "Our default certificates are valid for 90 days.",
              "as_of": "2026-08-18"
            }
          ]
        },
        {
          "field": "notes",
          "versions": [
            {
              "value": "Valid for only 45 days, in preparation for upcoming restrictions that will limit all certificates to at most 47 days.",
              "source": "https://letsencrypt.org/docs/profiles/",
              "source_quote": "And finally the resulting certificate is valid for only 45 days, in preparation for upcoming restrictions that will limit all certificates to at most 47 days.",
              "as_of": "2026-08-18"
            },
            {
              "value": "Validity Period is stated as 160 hours in the profile table; qualifies as a Short-Lived Subscriber Certificate under the Baseline Requirements and needs no revocation information.",
              "source": "https://letsencrypt.org/docs/profiles/",
              "source_quote": "The shortlived profile is identical to the tlsserver profile, with one key distinction: the resulting certificate is only valid for 6ish days.",
              "as_of": "2026-08-18"
            },
            {
              "value": "The FAQ states the default lifetime; the profiles documentation names the default profile 'classic'. Let's Encrypt recommends renewing 90 day certificates every 60 days. There is no way to adjust these lifetimes.",
              "source": "https://letsencrypt.org/docs/faq/",
              "source_quote": "Our default certificates are valid for 90 days.",
              "as_of": "2026-08-18"
            }
          ]
        }
      ]
    },
    {
      "ca_name": "Sectigo",
      "max_validity_days": "199",
      "still_active": "yes",
      "notes": "199 days is described as 6 months plus extra time to renew. Domain Control Validation reuse is limited to 198 days from the same date. Sectigo acquired Entrust's public certificate business (completed September 18, 2025).",
      "id": "sectigo",
      "url": "https://referencesource.org/ca-issuance-validity/sectigo/",
      "source": "https://www.sectigo.com/resource-library/shorter-validity-periods-for-tls-certificates-and-dcv",
      "source_quote": "To align with evolving industry requirements, Sectigo will begin enforcing a maximum TLS certificate validity of 199 days starting March 12, 2026.",
      "verified_fields": [
        "ca_name",
        "max_validity_days"
      ],
      "derived_fields": [
        "notes",
        "still_active"
      ]
    },
    {
      "ca_name": "SSL.com",
      "max_validity_days": "198",
      "still_active": "yes",
      "notes": "SSL.com issues 198 days, or the remaining duration of the certificate order, whichever is shorter; previously issued for 396 days. A purchase still represents a 12-month license period fulfilled through reissued 198-day certificates. The change took effect March 11, 2026.",
      "id": "ssl-com",
      "url": "https://referencesource.org/ca-issuance-validity/ssl-com/",
      "source": "https://www.ssl.com/blog/ssl-certificate-validity/",
      "source_quote": "To comply with the new requirement, SSL now issues certificates for 198 days, or the remaining duration of the certificate order, whichever is shorter.",
      "verified_fields": [
        "ca_name",
        "max_validity_days"
      ],
      "derived_fields": [
        "notes",
        "still_active"
      ]
    },
    {
      "ca_name": "ZeroSSL",
      "profile": "Annual",
      "max_validity_days": "200",
      "effective_since": "2026-03-15",
      "still_active": "yes",
      "notes": "Annual certificates provide one year of coverage through multiple certificate issuances; every new certificate follows the 200-day limit and requires a mid-term reissuance to cover the full 1-year period. ZeroSSL no longer offers single 1-year certificate issuances.",
      "id": "zerossl",
      "url": "https://referencesource.org/ca-issuance-validity/zerossl/",
      "source": "https://help.zerossl.com/hc/en-us/articles/34330849350173-SSL-TLS-Certificate-Validity-Changes-New-200-Day-Limit-Explained",
      "source_quote": "Starting March 15, 2026, SSL/TLS certificates can be issued for a maximum of 200 days . This reflects a shift from the previous 1\u2011year validity model to a shorter, more secure lifecycle.",
      "verified_fields": [
        "ca_name",
        "max_validity_days"
      ],
      "derived_fields": [
        "effective_since",
        "notes",
        "profile",
        "still_active"
      ],
      "disagreements": [
        {
          "field": "profile",
          "versions": [
            {
              "value": "Annual",
              "source": "https://help.zerossl.com/hc/en-us/articles/34330849350173-SSL-TLS-Certificate-Validity-Changes-New-200-Day-Limit-Explained",
              "source_quote": "Starting March 15, 2026, SSL/TLS certificates can be issued for a maximum of 200 days . This reflects a shift from the previous 1\u2011year validity model to a shorter, more secure lifecycle.",
              "as_of": "2026-08-18"
            },
            {
              "value": "ACME/free",
              "source": "https://zerossl.com/features/acme/",
              "source_quote": "ACME integrations let you order and renew 90-day certificates automatically and free of charge, using any major ACME client:",
              "as_of": "2026-08-18"
            }
          ]
        },
        {
          "field": "max_validity_days",
          "versions": [
            {
              "value": "200",
              "source": "https://help.zerossl.com/hc/en-us/articles/34330849350173-SSL-TLS-Certificate-Validity-Changes-New-200-Day-Limit-Explained",
              "source_quote": "Starting March 15, 2026, SSL/TLS certificates can be issued for a maximum of 200 days . This reflects a shift from the previous 1\u2011year validity model to a shorter, more secure lifecycle.",
              "as_of": "2026-08-18"
            },
            {
              "value": "90",
              "source": "https://zerossl.com/features/acme/",
              "source_quote": "ACME integrations let you order and renew 90-day certificates automatically and free of charge, using any major ACME client:",
              "as_of": "2026-08-18"
            }
          ]
        },
        {
          "field": "notes",
          "versions": [
            {
              "value": "Annual certificates provide one year of coverage through multiple certificate issuances; every new certificate follows the 200-day limit and requires a mid-term reissuance to cover the full 1-year period. ZeroSSL no longer offers single 1-year certificate issuances.",
              "source": "https://help.zerossl.com/hc/en-us/articles/34330849350173-SSL-TLS-Certificate-Validity-Changes-New-200-Day-Limit-Explained",
              "source_quote": "Starting March 15, 2026, SSL/TLS certificates can be issued for a maximum of 200 days . This reflects a shift from the previous 1\u2011year validity model to a shorter, more secure lifecycle.",
              "as_of": "2026-08-18"
            },
            {
              "value": "Free ACME-issued certificates are 90 days, renewable automatically with any major ACME client.",
              "source": "https://zerossl.com/features/acme/",
              "source_quote": "ACME integrations let you order and renew 90-day certificates automatically and free of charge, using any major ACME client:",
              "as_of": "2026-08-18"
            }
          ]
        }
      ]
    }
  ]
}