# What Is Short-Lived Certificate? Definition and Examples

> Short-lived certificates are TLS certificates valid for only a few days, so expiry rather than revocation limits how long a compromised one can be misused.

Source: https://ssl.sh/glossary/short-lived-certificate/
Last updated: 2026-11-10

A short-lived certificate has a validity period measured in days rather than months. The CA/Browser Forum Baseline Requirements give the term a specific meaning: under Ballot SC-063, subscriber certificates valid for 7 days or less (for certificates issued from 2026-03-15) count as short-lived and need not include OCSP or [CRL](https://ssl.sh/glossary/crl/) pointers. Let's Encrypt made six-day (160-hour) certificates generally available on 2026-01-15 through its shortlived [ACME profile](https://ssl.sh/glossary/acme-profile/), which is also the profile for its IP-address certificates.

## Why it matters
[Revocation](https://ssl.sh/glossary/revocation/) has long been unreliable: clients often skip status checks or soft-fail when they cannot complete them, OCSP is now optional for CAs, and Let's Encrypt has shut its OCSP service down. A certificate that expires within days caps the damage of a stolen key without depending on any revocation check. The price is that renewal must be fully automated and robust; with a six-day lifetime, a failed renewal job becomes an outage within days. ACME Renewal Information ([ARI](https://ssl.sh/glossary/ari/), RFC 9773) lets the CA tell clients when to renew.

## Example
```bash
openssl x509 -in cert.pem -noout -startdate -enddate
# notBefore=Nov 10 00:00:00 2026 GMT
# notAfter=Nov 16 16:00:00 2026 GMT    (160 hours after notBefore)
```

## Common misconceptions
- **Short-lived means weaker.** The cryptography is identical; only the validity window is shorter.
- **The coming 47-day limit makes every certificate "short-lived".** In Baseline Requirements terms, short-lived means 7 days or less; 47 days is the general maximum from 2029-03-15.
- **You can manage them by hand.** Renewal every few days is only practical with ACME automation and monitoring.

## Related terms

- [有效期](https://ssl.sh/zh/glossary/validity-period/): 有效期是证书中 notBefore 与 notAfter 两个时间之间的区间，只有在此区间内客户端才会接受这张证书。
- [证书吊销](https://ssl.sh/zh/glossary/revocation/): 证书吊销是 CA 在证书到期前宣布其作废的操作，通过 CRL 或 OCSP 对外公布，使客户端不再信任这张证书。
- [OCSP](https://ssl.sh/zh/glossary/ocsp/): OCSP 是 RFC 6960 定义的在线证书状态协议，客户端可以向 CA 的响应服务器查询某一张证书当前是有效、已吊销还是未知。
- [CRL](https://ssl.sh/zh/glossary/crl/): CRL 是由 CA 签名并定期重新发布的证书吊销列表，列出它在证书到期前就已吊销的证书序列号。
- [ACME Profile](https://ssl.sh/zh/glossary/acme-profile/): ACME Profile 是 CA 在 ACME 目录中公布的命名证书模板，客户端下单时选择它来决定证书的有效期和内容。
- [ARI](https://ssl.sh/zh/glossary/ari/): ARI 是 ACME 的扩展标准（RFC 9773），由 CA 告诉客户端某张证书应该在哪个时间窗口内续期。
- [证书续期](https://ssl.sh/zh/glossary/certificate-renewal/): 证书续期是在证书到期前申请一张新证书来替换它，最好全自动完成并同时更换密钥对。
- [Let's Encrypt](https://ssl.sh/zh/glossary/let-s-encrypt/): Let's Encrypt 是由非营利组织 ISRG 运营的免费、自动化证书颁发机构，通过 ACME 协议签发域名验证型 TLS 证书。