1

Using openSSL, it looks like the maximum -days I can use is 11499 based on the conversation here. However, if I want to sign it by a certification authority, how long will be the maximum certification duration?

1
  • That OpenSSL limit was on the end time, not the duration as such, and only for now-obsolete versions of OpenSSL on 32-bit systems; it was an instance of the 'Y2038' bug. Current OpenSSL no longer has that bug (as you could have determined by a trivial test) and most systems today are 64-bit anyway. Mar 10, 2021 at 5:05

1 Answer 1

4

As of September 1, 2020, 12 months. This was a change agreed upon by the major certificate authorities and aligns with the wishes of the browser manufacturers (Apple, Mozilla, Chrome, etc.) You can still issue self-signed certificates via OpenSSL with whatever duration you wish, but you may run into trouble with browsers accepting them.

I believe the intent behind this policy change was to force people to pay more attention to their certificates. For example (just making up durations here), if I just purchased a 3 year certificate yesterday and installed it, and a security change (such as a weak encryption algorithm) is discovered today, I would not technically HAVE to replace the certificate until 3 years from now. With the new shorter durations, I will have to replace it within 1 year.

2
  • 1
    In addition, if the certificate is not to be verified by browsers, the certificate can be longer than 12 months. Mar 1, 2021 at 18:01
  • 1
    Fair point! Although I would suggest that the overwhelming majority of certificates purchased/obtained are intended for end user/browsing traffic. Don't know, and it's probably of not much value to bring it up or discuss it, but it wouldn't surprise me if that percentage is > 98%. Mar 1, 2021 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.