Ballot 193: TLS certificate lifetime capped at 825 days

Ballot 193 ended the three-year TLS certificate. Certificates issued after 2018-03-01 could be valid for at most 825 days (about 27 months) instead of 39 months, and CAs could reuse validation data for no more than 825 days.

What changed

Ballot 193 amended §4.2.1 and §6.3.2 of the Baseline Requirements and the EV Guidelines. Its purpose statement says Ballot 185, which had proposed a much shorter maximum and failed, still showed consensus for reducing DV and OV lifetimes from 39 months to 825 days. The 825-day limit also replaced 39 months as the maximum age of reused validation documents and data, and the EV Guidelines set EV certificates to 825 days as well. It was proposed by Entrust Datacard and endorsed by Comodo, DigiCert and GlobalSign.

Effective dates

The ballot passed on 2017-03-17. Under the BR text, subscriber certificates issued after 2018-03-01 must have a validity period no greater than 825 days. A follow-up ballot (197) adjusted when the provisions took effect, so 2018-03-01 is the date that mattered in practice.

Who is affected

Everyone who bought TLS certificates in 2018–2020: three-year certificates disappeared, and two-year certificates became the longest option until browsers enforced 398 days in 2020.

What to do

No action is needed today: two later ballots have superseded the rule. SC-031 lowered the cap to 398 days from 2020-09-01, and SC-081v3 lowers it to 200, 100 and finally 47 days. See the certificate validity timeline.