# What Is Validity Period (notBefore / notAfter)?

> Validity period is the time window between a certificate's notBefore and notAfter dates during which clients will accept it.

Source: https://ssl.sh/glossary/validity-period/
Last updated: 2026-11-10

Every [X.509](https://ssl.sh/glossary/x509/) certificate states its validity as two timestamps, notBefore and notAfter, and clients reject it outside that window. For publicly trusted TLS certificates, the CA/Browser Forum caps the maximum validity by issuance date. Ballot SC-081v3 sets 398 days for certificates issued before 2026-03-15, 200 days from 2026-03-15, 100 days from 2027-03-15 and 47 days from 2029-03-15, so as of November 2026 the limit is 200 days.

## Why it matters
Shorter lifetimes limit how long a mis-issued certificate or a stolen key stays useful, especially because revocation checking is unreliable, and they force automation. The cap has fallen steadily: 60 months for certificates issued after 2012-07-01, 39 months after 2015-04-01, 825 days from 2018-03-01 and 398 days from 2020-09-01. Let's Encrypt goes further than the maximum: its tlsserver profile has issued 45-day certificates since 2026-05-13, its shortlived profile issues six-day certificates, and its default classic profile moves to 64 days on 2027-02-10. Plan [renewal](https://ssl.sh/glossary/certificate-renewal/) with [ACME](https://ssl.sh/glossary/acme/), not with calendar reminders.

## Example
```bash
openssl x509 -in cert.pem -noout -dates
openssl x509 -in cert.pem -noout -checkend 2592000 && echo "valid for at least 30 more days"
```

`-checkend` takes seconds and exits non-zero if the certificate expires within that time.

## Common misconceptions
- **A multi-year purchase means installing once.** Multi-year subscriptions still deliver certificates within the current maximum; each one must be reissued and reinstalled.
- **Shorter certificates are less secure.** Lifetime does not affect encryption; shorter lifetimes reduce the damage from a compromised key.
- **The device clock does not matter.** A client with a wrong date reports valid certificates as expired or not yet valid.

## Related terms

- [证书续期](https://ssl.sh/zh/glossary/certificate-renewal/): 证书续期是在证书到期前申请一张新证书来替换它，最好全自动完成并同时更换密钥对。
- [短期证书](https://ssl.sh/zh/glossary/short-lived-certificate/): 短期证书是有效期只有几天的 TLS 证书，靠快速过期而不是吊销来限制被盗证书可被滥用的时间。
- [证书生命周期管理](https://ssl.sh/zh/glossary/certificate-lifecycle-management/): 证书生命周期管理（CLM）是对证书从发现、申请、部署、续期到吊销全过程进行跟踪和自动化的做法与工具。
- [Baseline Requirements](https://ssl.sh/zh/glossary/baseline-requirements/): Baseline Requirements 是 CA/B 论坛制定的基线要求，规定公开信任的 CA 在验证、签发和吊销 TLS 服务器证书时必须遵守的规则。
- [ACME](https://ssl.sh/zh/glossary/acme/): ACME 是 IETF 标准协议（RFC 8555），让软件自动向 CA 证明域名控制权，并自动申请、续期和吊销证书。
- [ARI](https://ssl.sh/zh/glossary/ari/): ARI 是 ACME 的扩展标准（RFC 9773），由 CA 告诉客户端某张证书应该在哪个时间窗口内续期。