# SSL Certificate Validity Calculator: 200, 100 and 47 Days

> Max TLS certificate lifetime for any issue date under SC-081 (398, 200, 100, 47 days), expiry and renewal dates, .ics reminder.

Source: https://ssl.sh/tools/validity-calculator/
Last updated: 2026-11-10

Enter an issue date to see the maximum certificate lifetime allowed on that date, when the certificate expires and when to renew, with a calendar reminder.

The validity calculator tells you how long a TLS certificate issued on a given date can be valid, when it will expire and when you should renew it. Enter the issue date and, optionally, the lifetime you want; the result applies the CA/Browser Forum limits and offers a calendar reminder as an `.ics` file. Everything is calculated in your browser.

## How to use it

1. Pick the **issue date** (today by default).
2. Optionally enter the **requested validity** in days, for example 90 for Let's Encrypt or 365 for a commercial certificate. Leave it empty to use the maximum.
3. Press **Calculate**. If you asked for more than allowed, the result is capped and a warning explains why.
4. Press **Download .ics reminder** to add the renewal and expiry dates to your calendar.

## The SC-081 schedule

| Issued | Maximum validity | Domain validation reuse |
|---|---|---|
| before 15 March 2026 | 398 days | 398 days |
| 15 March 2026 – 14 March 2027 | 200 days | 200 days |
| 15 March 2027 – 14 March 2029 | 100 days | 100 days |
| from 15 March 2029 | 47 days | 10 days |

As of November 2026 the 200-day limit applies. See the [certificate validity timeline](https://ssl.sh/timeline/certificate-validity/) for the history.

## What the results mean

- **Expires**: issue date plus the validity used.
- **Renew on**: after two thirds of the lifetime. Renewing earlier is fine; later leaves little room for errors.
- **Renewals per year**: about 3 with today's 200-day certificates and about 12 with 47-day certificates, which is why manual renewal stops being practical.

To check what is actually deployed, use the [bulk SSL checker](https://ssl.sh/tools/bulk-ssl-checker/); to stop worrying about dates, [automate renewal](https://ssl.sh/learn/automate-certificate-renewal/) with ACME.


## FAQ

**Does the new limit shorten certificates I already have?**

No. A certificate keeps the validity it was issued with. The limit applies to certificates issued on or after each date, so a 398-day certificate issued on 14 March 2026 remains valid until it expires.

**Why renew after two thirds of the lifetime?**

It leaves a third of the lifetime to notice and fix failed renewals. For a 90-day certificate that is 30 days of margin; for a 47-day certificate about 16 days. Let's Encrypt recommends the same rule, and ACME Renewal Information (ARI) can tell clients the exact window.

**Can I buy a longer certificate to avoid the change?**

Not from a public CA. Multi-year products are subscriptions: the CA reissues a new certificate within the allowed lifetime, and each reissue must be installed. Automate installation with ACME where possible.

**Do these limits apply to private CAs?**

No. They apply to publicly trusted TLS server certificates. Internal CAs set their own policies, although many follow the same direction.