1

Let a CA generate a new X.509 certificate for the web. I wonder about the rules for the validity period:

(Q1) On what does the validity period depend on ?

(Q2) Does it depend on the pricing model (the longer the more expensive) ?

(Q3) Does it depend on legal restrications ?

(Q4) Do all CAs assign the same validity period or do they differ between CAs ?

(Q5) Has the subject (who purchases the certificate) influence on the validity period ?

  • 1
    What research have you done yet? – StackzOfZtuff Nov 6 '17 at 18:52
  • I googled for "validity period", but what I found was just the definition of it but not CAs rules. – user120513 Nov 6 '17 at 19:00
2

WebPKI?!?

NOTE: All these answers assume you're talking about CERTIFICATES FOR THE WEB (WebPKI). (Not for code signing, e-mail, etc.) Please let me know if this is indeed what you wanted to know.

Now in case you were NOT talking about WebPKI, you may want to take a look at the respective CA's "Certification Practice Statements" (CPS).

Example: Digicert's CPS lists their validity periods here: https://www.digicert.com/wp-content/uploads/2017/09/DigiCert_CPS_v412.pdf#page=49

Q1

Money.

The longer, the more expensive. See for example: https://www.digicert.com/buy-ssl-certificates/ (Archived here: https://archive.is/G5D9p)

Q2

Yes. See above.

Q3

Not sure. I don't think so.

Q4

DV

They're pretty much all bound to the BASELINE REQUIREMENTS for the regular kind of certs, which are DV (domain validated) certs. -> https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.5.4.pdf

And the BRs currently define a limit of 3 years + 3 months. (39 months)

But this will change next year. Then the limit will be 2 years + 3 months. (825 days to be precise.)

Nice blog about this change is here: https://www.entrustdatacard.com/blog/2017/march/maximum-certificate-lifetime-drops-to-825-days-in-2018 (Archived here: https://archive.is/JCa2M)

EV

Now for EV (extended validation) certs the rules are laid out here: https://cabforum.org/wp-content/uploads/EV-V1_6_7.pdf

And they have this to say:

9.4. Maximum Validity Period For EV Certificate
The validity period for an EV Certificate SHALL NOT exceed 825 days. It is RECOMMENDED that EV Subscriber Certificates have a maximum validity period of twelve months.

-- To be honest I have no idea at all what kind of weight a statement like "It is RECOMMENDED" carries. (I'm genuinely interested. Does anybody care about such a recommendation? Are there soft sanctions, like being frowned upon or something? -- Please leave a comment if you know more.)

But take the Digicert link from above: they currently do offer 2 year EV certs. (In spite of the recommendation.)

Q5

Yes. You pay more, you get longer validity. (Up to the limit mentioned above.)

  • You are right, the question concerns WebPKI. Thanks for clarifying. – user120513 Nov 6 '17 at 19:20
  • Thank you very much for the answer. The infos and links are very interesting/helpful. (Unfortunately I can't upvote your answer because of rep limitations) – user120513 Nov 6 '17 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.