Currently, SSL certificate issuers will only be provided to customers with a maximum of two years.
Accordingly, the maximum time limit for an SSL certificate will be 825 days, which is equivalent to 2 years of official term and 3 months of trial.
This policy has been set since March 2017 under the auspices of the CA/Browser Forum (CAB) – which sets the rules around the issuance and verification of SSL certificates. Members of the CAB forum include Certificate Authorities and Web browsers.
Cutting the maximum validity period to two years was adopted with almost 100% of the votes cast. As follows:
- 24/27 vote issuer vote “agree”; 3/27 remaining are blank.
- 5/6 representatives browse the web vote “agree”; Mozilla specifically to blank slots.
This is not the only time the maximum validity of SSL certificates has been reduced. Prior to that, in 2015, the maximum deadline was also reduced from 4-5 years to 3 years.
In fact, the unsubscription of up to 3 years has been made since February 20, 2018 with certificates of GeoTrust/RapidSSL/Symantec/Thawte. With Comodo, apply from 28/02/2018.
What does the new policy affect the current SSL certificate users?
- As of March 1, 2018, you will no longer be able to purchase SSL certificates for a period of three years – of course.
- For customers who have purchased an SSL certificate for a period of 3 years prior to February 28, 2018, the terms remain unchanged. Only when the certificate expires will you need to buy/renew for a shorter period of time.
- Three-year certificates have expired and will be renewed on March 1, 2018. They will have to comply with the new regulations and have a maximum validity of 2 years.
So why is this reduction necessary?
Members of the CAB forum believe that the shorter the validity of SSL certificates, the higher the level of credibility, level of security, and security of authentication.
Currently, CAB is also considering and the possibility in the near future, the time limit will be reduced to only 1 year.