Configure
Certificate validity calculator
Enter an issue date to see the maximum certificate lifetime allowed on that date, when the certificate expires and when to renew, with a calendar reminder.
Runs in your browser Everything you enter is processed locally with JavaScript and is never uploaded to ssl.sh.
| Issued | Max validity (days) |
|---|---|
| Before 2026-03-15 | 398 |
| 2026-03-15 – 2027-03-14 | 200 |
| 2027-03-15 – 2029-03-14 | 100 |
| From 2029-03-15 | 47 |
The validity calculator tells you how long a TLS certificate issued on a given date can be valid, when it will expire and when you should renew it. Enter the issue date and, optionally, the lifetime you want; the result applies the CA/Browser Forum limits and offers a calendar reminder as an .ics file. Everything is calculated in your browser.
How to use it
- Pick the issue date (today by default).
- Optionally enter the requested validity in days, for example 90 for Let's Encrypt or 365 for a commercial certificate. Leave it empty to use the maximum.
- Press Calculate. If you asked for more than allowed, the result is capped and a warning explains why.
- Press Download .ics reminder to add the renewal and expiry dates to your calendar.
The SC-081 schedule
| Issued | Maximum validity | Domain validation reuse |
|---|---|---|
| before 15 March 2026 | 398 days | 398 days |
| 15 March 2026 – 14 March 2027 | 200 days | 200 days |
| 15 March 2027 – 14 March 2029 | 100 days | 100 days |
| from 15 March 2029 | 47 days | 10 days |
As of November 2026 the 200-day limit applies. See the certificate validity timeline for the history.
What the results mean
- Expires: issue date plus the validity used.
- Renew on: after two thirds of the lifetime. Renewing earlier is fine; later leaves little room for errors.
- Renewals per year: about 3 with today's 200-day certificates and about 12 with 47-day certificates, which is why manual renewal stops being practical.
To check what is actually deployed, use the bulk SSL checker; to stop worrying about dates, automate renewal with ACME.
FAQ
Does the new limit shorten certificates I already have?
No. A certificate keeps the validity it was issued with. The limit applies to certificates issued on or after each date, so a 398-day certificate issued on 14 March 2026 remains valid until it expires.
Why renew after two thirds of the lifetime?
It leaves a third of the lifetime to notice and fix failed renewals. For a 90-day certificate that is 30 days of margin; for a 47-day certificate about 16 days. Let's Encrypt recommends the same rule, and ACME Renewal Information (ARI) can tell clients the exact window.
Can I buy a longer certificate to avoid the change?
Not from a public CA. Multi-year products are subscriptions: the CA reissues a new certificate within the allowed lifetime, and each reissue must be installed. Automate installation with ACME where possible.
Do these limits apply to private CAs?
No. They apply to publicly trusted TLS server certificates. Internal CAs set their own policies, although many follow the same direction.