The public SSL certificate vendors (Comodo, Thawte, etc.) allow you to create certs that expire after a certain fixed period (1 yr, 2yr, 3yr, etc.) from the date of creation.

However, I would like to create a SSL Certificate with a very specific expiration date in the future. The future date can be anywhere between 1 and 2 years (i.e. Letsencrypt's is not a candidate).

Is there a vendor that allows custom value in the Expiration Date?

Update: Adding more information as suggested by Steffen:

I would like to alleviate the expiration anxiety around cert pinning and rotation on the mobile app. So, I want to bundle multiple certs in the mobile app, with staggered expiration dates 6 mo apart in the future.

The mobile app would look for a match with any one of the certs in the bundle. On the server side, the cert rotation would be scheduled every 6 months.

Since the replaced cert would already be present in the mobile app, the server side rotation would not affect the mobile app's pinning.

Hope this explains the requirement. If this problem has been solved with a better method, please let me know. I think it is related to security (cert pinning / rotation), but happy to move out of your way if you think otherwise.

  • 2
    Just because certificates are involved does not mean that this question is relevant for this site. As it stands now you ask for a vendor/product recommendation which is off-topic. On-topic would be instead if you would describe the security problem you are trying to solve with such custom expiration date. Based on this one could discuss a solution to this problem which might or might not involve custom expiration times. – Steffen Ullrich Dec 13 '16 at 21:47
  • 1
    I think the way this problem is normally solved would be from the other end: 6 months before the certificate expires, get a new certificate and push an update out with it pinned as well as the previous one. – demize Dec 13 '16 at 23:34
  • Most vendors allow max 3 mo before expiration though. If you have a vendor recommendation for this option, I would appreciate. – Puneet Dec 13 '16 at 23:40
  • (I am sorry, this question is sounding too much like a vendor related question) – Puneet Dec 13 '16 at 23:41
  • 4
    Have you considered creating your own CA / leaf certificate? If you control both client and server you do not need to rely on a CA. – Maarten Bodewes Dec 14 '16 at 0:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.