Aisle 03 · Shelf life
How long a certificate lasts, and what each label means.
A certificate carries a best-before date (its "not after" time). After it, browsers refuse it. Public certificates are getting shorter lives every few years.
The longest life allowed
Set by the CA/Browser Forum's Baseline Requirements (ballot SC-081, 2025) for publicly trusted TLS certificates, by the date a certificate is issued:
| Issued from | Longest life | Hand renewals a year |
|---|---|---|
| 2020-09-01 | 398 days | 1 |
| 2026-03-15 | 200 days | 2 |
| 2027-03-15 | 100 days | 4 |
| 2029-03-15 | 47 days | 8 |
Let's Encrypt and most automated issuers already use 90 days or less. The steps are the maximum; an authority may issue shorter.
The labels
- FreshMore than 30 days left on the newest certificate.
- Renew soon30 days or fewer left. Fine for a certificate that renews itself in time; a reminder for one renewed by hand.
- Late renewalLifetime 100 days or less, fewer than 20 days and less than 22% of its life left, no newer certificate logged. Automatic renewers (certbot, cPanel AutoSSL, Caddy and others) renew well before this, so check yours is still running.
- Past best-beforeThe newest certificate for the name has expired. Either the name is not used any more (fine, but it is still public), or a renewal lapsed.
- CoveredIts own certificate has expired, but an in-date wildcard certificate for the parent covers it.
When a label is red
- Late renewal: open your host's SSL page or run your renewal tool's dry run (for certbot:
certbot renew --dry-run). Fix what it reports, then recount. - Past best-before, name still in use: issue a new certificate for it now, install it, then press "Check the counter".
- Counter says "older one": the new certificate exists but the server still hands out the old one. Reload or restart the web server, or install the new files in your control panel.
- An issuer you do not know: ask your host which authority it uses. If nobody ordered it, contact that authority, and consider a CAA record.