Security fundamentals

SSL/TLS Certificates Explained: Types, Expiry, Checks

An SSL/TLS certificate is a digitally signed X.509 document that ties a public key to a name such as example.com, so a browser can set up an encrypted connection to the right server. A certificate authority (CA) signs it, and it is only valid between its notBefore and notAfter dates.

The big change for anyone who manages certificates: maximum lifetimes are shrinking to 200 days now, 100 days in 2027 and 47 days in 2029 (details below). Paste any certificate into the SSL decoder to read its fields.

Updated 3 November 2026

How a certificate works

The certificate contains the subject's public key, the names it covers, the issuer, and a validity period with notBefore and notAfter times (RFC 5280, section 4.1.2.5).
Names are carried in the Subject Alternative Name (SAN) extension (RFC 5280, section 4.1.2.6 and 4.2.1.6).
The CA signs it. A client trusts it if it can build a chain from the server's certificate through any intermediates to a root it already trusts, which RFC 5280 section 6 defines as path validation. Practise this in the certificate chain lab.
CAs can also publish certificate revocation lists (RFC 5280 section 5). See how to check revocation.

DV, OV and EV certificates

Type	What it shows	Source detail
DV (domain validated)	The requester controls the domain name.	Policy OID 2.23.140.1.2.1 in the Baseline Requirements.
OV (organization validated)	Domain control plus a vetted organisation.	OID 2.23.140.1.2.2.
IV (individual validated)	Domain control plus a vetted individual.	OID 2.23.140.1.2.3.
EV (extended validation)	Stricter organisation vetting.	Defined in the CA/Browser Forum EV Guidelines, a separate document.

Let's Encrypt states that it issues only DV certificates and has no plans to issue OV or EV.

Certificate lifetimes are getting shorter

The Baseline Requirements' relevant-dates table sets the maximum validity of publicly trusted subscriber certificates:

Certificates issued on or after	Maximum validity
15 March 2026	200 days
15 March 2027	100 days
15 March 2029	47 days

The CA/B Forum also shortens how long domain validation results can be reused. Let's Encrypt, per its December 2025 post, defaults to 90-day certificates today, offers 45-day certificates in an opt-in profile from 13 May 2026, and plans to move its default to 64 days on 10 February 2027 and 45 days on 16 February 2028. Its six-day profile is opt-in.

The practical result: manual renewals stop being workable. Automate issuance (for example with ACME) and monitor expiry. Walk through it in the rotation lab. Private CAs inside your organisation are not bound by these public limits.

What to check on a certificate

Hostname: the name you visit is in the SAN list.
Dates: today is between notBefore and notAfter, and you know how many days remain.
Chain: the server sends the intermediates and the chain reaches a trusted root.
Issuer: it is the CA you expect.
Revocation: the certificate has not been revoked.

The SSL decoder exposes these fields. A padlock only says the connection is encrypted to a trusted certificate; it does not say the site is honest.

Last reviewed 3 November 2026. Lifetime limits apply to publicly trusted TLS certificates issued after each date; confirm against the current Baseline Requirements before planning.

Frequently asked questions

What is an SSL/TLS certificate?

An X.509 certificate that binds a public key to one or more names (for websites, hostnames) and is signed by a certificate authority. RFC 5280 profiles the X.509 v3 certificate for Internet use, including its validity period and Subject Alternative Name extension. “SSL” is the old name; the protocol in use today is TLS.

What is the difference between DV, OV and EV certificates?

The CA/Browser Forum Baseline Requirements reserve separate policy identifiers for domain-validated (2.23.140.1.2.1), organization-validated (2.23.140.1.2.2) and individual-validated (2.23.140.1.2.3) certificates. DV validates control of the domain name; OV additionally validates the organisation. Extended Validation is specified in the separate EV Guidelines. Let’s Encrypt issues only DV certificates.

How long can an SSL certificate be valid?

For publicly trusted TLS certificates, the Baseline Requirements set a maximum of 200 days for certificates issued from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Check your CA’s own page, as many issue for shorter than the maximum.

Is Let’s Encrypt free and how long do its certificates last?

Yes, Let’s Encrypt does not charge for certificates. Per its FAQ, default certificates last 90 days and it recommends renewing every 60 days; a six-day certificate is opt-in. Its announced schedule moves the default to 64 days on 10 February 2027 and 45 days on 16 February 2028.

What happens when a certificate expires?

Clients treat the certificate as outside its validity period (RFC 5280 defines notBefore and notAfter) and typically show a security warning or refuse the connection. Automating renewal and monitoring expiry avoids the outage.

Does the padlock mean a site is safe?

No. It means the connection to that hostname is encrypted with a certificate the browser trusts. A DV certificate only demonstrates control of the domain name, so phishing sites can have valid certificates. Judge the domain itself.

What should I check on a certificate?

The hostname appears in the Subject Alternative Name list, the dates are current, the chain builds to a trusted root, the issuer is expected, and the certificate has not been revoked. Our SSL decoder shows these fields from a pasted certificate.