Maximum Lifespan of SSL/TLS Certificates is 398 Days Starting Today

In a move that’s meant to boost security, Apple, Google, and
Mozilla are set to reject publicly rooted digital certificates in
their respective web browsers that expire more than 13 months (or
398 days) from their creation date.

The lifespan of SSL/TLS certificates has shrunk significantly
over the last decade. In 2011, the Certification Authority Browser
Forum (CA/Browser Forum), a consortium of certification authorities
and vendors of browser software, imposed a limit of five years,
bringing down the certificate validity period from 8-10 years.

Subsequently, in 2015, it was cut short to three years and two
years again in 2018.

Then in February this year, Apple^[2] became the first company
to announce that it intends to reject new TLS certificates issued
on or after September 1 that have a validity of more than 398 days.
Since then, both Google^[3] and Mozilla^[4] have followed suit to
enforce similar 398-day limits.

Certificates issued before the enforcement date won’t be
impacted, neither those that have been issued from user-added or
administrator-added Root certificate authorities (CAs).

“Connections to TLS servers violating these new requirements
will fail,” Apple explained in a support document^[5]. “This might cause
network and app failures and prevent websites from loading.”

For its part, Google intends to reject certificates that violate
the validity clause with the error “ERR_CERT_VALIDITY_TOO_LONG” and
treat them as misissued.

Additionally, some SSL certificate providers, such as Digicert^[6] and Sectigo^[7] have already stopped
issuing certificates with a two-year validity.

To avoid unintended consequences, Apple recommends that
certificates be issued with a maximum validity of 397 days.

Why Shortent Certificate Lifespan?

Capping certificate lifetimes improve website
security because it reduces the period in which compromised or
bogus certificates can be exploited to mount phishing and malware
attacks.
That’s not all. Mobile versions of Chrome and Firefox do not
proactively check for certificate status due to performance
constraints, causing websites with revoked certificates to load
without giving any warning to the user.

For developers and site owners, the development is a good time
to implement certificate automation using tools such as Let’s
Encrypt^[9] and EFF’s CertBot^[10], which offer an easy
way to set up, issue, renew, and replace SSL certificates without
manual intervention.

“Expired certificates continue to be a massive problem, costing
companies millions of dollars due to outages every year,” said
Chris Hickman, the chief security officer at Keyfactor. “On top of
that, more frequent expired certificate warnings may result in web
visitors becoming more comfortable bypassing the security warnings
and error messages.”

“However, certificate subscribers frequently forget how or when
to replace certificates, causing service outages from unexpected
expiration […] leaving them ill-equipped to manage these new
shorter life certificates at scale.”

^[1][8]