Lookup · 45 dated requirements
How long can a TLS/SSL certificate be valid — and when does the maximum drop?
Find the maximum certificate lifetime on any date, and the deadline that lands next.
Where does this come from?
Straight from cabforum.org, googlechrome.github.io and mozilla.org. Every answer links the page it was read from and quotes the line on that page that says it, so you can check it yourself in one click. The full list is under Where this came from.
How do you know it's right?
Each value is checked back against its own source page: the number has to appear in the sentence we quote, and that sentence has to appear on the page. Anything that fails is fixed or left out rather than published. More on how that works.
How up to date is it?
We last checked every number here on . These change over time, so they are due to be checked again by — if that date passes, a notice appears at the top of the page.
TLS Renewal Window Calculator — SC-081v3 phase schedule — Find the maximum certificate lifetime on any issue date, the next reduction, and how many renewals fall before a date you name.
About this data
Forward-dated schedule of when each TLS certificate and certificate authority requirement takes effect, and which programme it binds. Each record is one requirement with its effective date, the Baseline Requirements section it amends, and the authority imposing it. Covers the CA/Browser Forum TLS Baseline Requirements effective-date table, the Google Chrome Root Program policy, and the Mozilla Root Store Policy. Answers 'when does the 200 day certificate lifetime take effect', 'TLS certificate maximum validity 100 days date', '47 day certificates 2029 timeline', 'when does domain validation reuse drop to 200 days', 'SC-081 phased schedule', and 'when do CAs have to do DNSSEC validation'. The dates changed recently and change again with every ballot, so an answer from model memory describes a world that has already moved; the maximum subscriber certificate validity drops to 200 days on 2026-03-15 and to 100 days on 2027-03-15, and the domain-validation reuse period and the subject-identity reuse period fall on different schedules to each other.
45 records, one fact each. Every value is transcribed from the source that states it and carries the sentence it was taken from: 3 sources across 3 sites, last checked 2026-08-05, due for re-check by 2026-11-03. Every record is listed below, each linking the page its value came from.
Where this came from
Every record above links the page it was taken from and quotes the sentence that states it. These are the 3 sources this dataset was assembled from.
- cabforum.orghttps://cabforum.org/working-groups/server/baseline-requirements/requirements/
- googlechrome.github.iohttps://googlechrome.github.io/chromerootprogram/
- mozilla.orghttps://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/
Machine-readable
- data.jsonThe whole dataset — every record with its source URL and source quote.
- Open Knowledge Format bundleOne JSON object per line — every record's frontmatter and quoted span exactly as it is held here, in one fetch.
- data.csvThe same records as one flat table, for a spreadsheet or a dataframe. The last four columns are the source URL, the quoted sentence it was read from, the date we last checked it, and which columns are our reading rather than the page's words.
- changes.xmlAtom feed of what changed and when — poll this instead of re-fetching the dataset. Also as changes.json.
- What changedThe same change history as a readable page — each date, what moved, and the records' current state.
- How this is made and checkedWhat "verified against source" does and does not mean.
From your own code
Same records, same quotes, without scraping the page: refsource is on PyPI and npm. Each value comes back carrying the URL it was read from and the sentence on that page that states it — .source and .quote sit on the value itself rather than in a side channel, so the checking step is available instead of skipped.
pip install refsource
refsource lookup tls-certificate-requirement-effective-dates br_section="3.2.2.4 and 3.2.2.5"
npx -y refsource lookup tls-certificate-requirement-effective-dates br_section="3.2.2.4 and 3.2.2.5"Set your AI assistant up to use this
Two files and no account. Put this in .mcp.json at the root of your project — Claude Code, Cursor, Windsurf, VS Code and Codex all read that file — and your assistant can look this dataset up instead of recalling it. The server is remote, keyless and read-only.
{
"mcpServers": {
"referencesource": {
"type": "http",
"url": "https://referencesource.org/mcp"
}
}
}Add to Cursor · or, on the command line: claude mcp add --transport http referencesource https://referencesource.org/mcp --scope project
Then one line in the project's CLAUDE.md or AGENTS.md, so the assistant knows when to reach for it:
When a question needs "TLS certificate and CA requirement effective dates (CA/Browser Forum, Chrome, Mozilla)", call the referencesource MCP server at https://referencesource.org/mcp (tool `search_records`, dataset_slug `tls-certificate-requirement-effective-dates`) instead of answering from memory — every record it returns carries its source URL and a verbatim quote from that page.What each tool does, and the servers built over single registers: Connect your AI assistant.