How to use this calculator
- Enter or choose issued on (not before).
- Enter or choose lifetime given as.
- Enter or choose check on.
- Enter or choose renew this many days before expiry.
- The days until expiry updates as you type. Use Copy result or Share to keep it.
Method
Expiry = Issue date + Validity days; Days left = Expiry − Check date; Renew on = Expiry − Lead days
- Validity days
- certificate lifetime
- Lead days
- how early you want to renew
Worked example
- 1 October + 90 days: +30 → 31 October, +30 → 30 November, +30 → 30 December 2026.
- From 29 October to 30 December: 2 + 30 + 30 = 62 days.
- Renewing 30 days ahead means by 30 November 2026.
A 90-day certificate issued on 1 October 2026 expires on 30 December 2026: 62 days left on 29 October, renew by 30 November.
What the result means
Automate renewal where you can (ACME clients such as certbot) and monitor the expiry date independently, since a missed renewal takes the site offline for visitors with a browser warning.
Assumptions and limits
- Whole calendar days in UTC; the exact expiry time of day is in the certificate’s notAfter field.
- Maximum lifetimes for publicly trusted certificates are set by the CA/Browser Forum and are being reduced in stages; check your CA’s current limit.
Questions
How long can a public TLS certificate be valid?
The CA/Browser Forum’s ballot SC-081v3, passed in April 2025, reduces the maximum in stages from 398 days, starting in March 2026, to 47 days by March 2029.
How do I find my certificate’s dates?
Click the padlock in your browser and view the certificate, or run openssl x509 -noout -dates on the certificate file.