1# Certificate Lifetimes 2 3As part of our ongoing commitment to ensuring users’ security, Google is 4reducing the maximum allowed lifetimes of TLS certificates. 5 6## Upcoming Changes 7 8Beginning with Chrome 85, TLS server certificates issued on or after 92020-09-01 00:00:00 UTC will be required to have a validity period of 398 days 10or less. This will only apply to TLS server certificates from CAs that are 11trusted in a default installation of Google Chrome, commonly known as 12"publicly trusted CAs", and will not apply to locally-operated CAs that have 13been manually configured. 14 15Certificates that do not comply with this requirement will not work, and may 16cause webpages to fail to load or to render incorrectly. 17 18If a certificate that does not comply with this requirement is issued by a CA 19trusted in a default installation of Google Chrome, this will be treated as a 20failure to comply with the security policies necessary to being a trusted CA, 21and may result in the removal of trust of that CA’s certificates. 22 23## Technical Details 24 25* A certificate will be impacted by this restriction if either the notBefore 26 of the certificate is on or after 2020-09-01 00:00:00 UTC, or if the first 27 precertificate logged by the CA to a Certificate Transparency Log that is 28 qualified at time of issuance is on or after this date. 29* The validity period of a certificate is defined within RFC 5280, Section 30 4.1.2.5, as "the period of time from notBefore through notAfter, inclusive." 31* 398 days is measured with a day being equal to 86,400 seconds. Any time 32 greater than this indicates an additional day of validity. 33* To avoid the risk of misissuance, such as due to leap seconds or 34 CA-configured randomization, CAs SHOULD issue such server certificates with 35 validity periods of 397 days or less. 36 37## Frequently Asked Questions 38 39* Why is Chrome making this change? 40 * Shortening certificate lifetimes protects users by reducing the impact 41 of compromised keys, and by speeding up the replacement of insecure 42 technologies and practices across the web. Key compromises and the 43 discovery of internet security weaknesses are common events that can lead 44 to real-world harm, and the web’s users should be better protected against 45 them. 46* Does this apply to locally-operated CAs, such as those used within 47 enterprises that use enterprise-configured configured CAs? 48 * No. This only applies to the set of CAs that are trusted by default by 49 Google Chrome, and not CAs that are operated by an enterprise and that 50 have no certification paths to CAs that are trusted by default. 51* Is there an enterprise policy to disable this enforcement? 52 * No. These changes are transparent and do not offer an enterprise control 53 to override, as they only apply to so-called "publicly trusted" CAs. 54 Enterprises that wish to have certificates with validity periods longer 55 than 398 days may do so by using a locally-operated CA that does not have 56 any certification paths up to a publicly trusted CA. 57* Does this mean I have to replace my existing certificates? 58 * No. This requirement only applies to new certificate issuance on or after 59 2020-09-01 00:00:00 UTC. Existing certificates whose validity period 60 exceeds 398 days will continue to work, while new certificates must comply 61 with these new requirements, such as when they are renewed or replaced. 62* Will this make certificates more expensive? 63 * As with past changes to the maximum certificate lifetimes, many CAs have 64 committed to providing additional certificates, as needed by the shortened 65 maximum lifetime, at no additional cost. 66* What will happen if a certificate is issued that does not meet these 67 requirements? 68 * Google Chrome will reject such certificates as having too long a validity 69 period, consistent with existing validity-period based enforcement. 70 Additionally, such certificates will be treated as a critical security 71 failure by the CA, and may result in further action taken on the CA that 72 may affect how current or future certificates from that CA function. 73 Chromium-based browsers will have this enforcement enabled by default, and 74 will need to modify the source to disable this. 75* What are other browsers doing? 76 * Apple previously announced this change for versions of iOS, iPadOS, macOS, 77 tvOS, and watchOS, as documented at 78 https://support.apple.com/en-us/HT211025, which will apply to all 79 applications, and not just those of Safari. This certificate lifetime 80 requirement is fully interoperable with Apple’s requirements. 81 82 Microsoft, Mozilla, Opera, and 360 have previously indicated their support 83 for these requirements, although have not yet made announcements at the 84 time of this post (2020-06-22). Other browsers, including those browsers 85 based on Chromium, may provide additional guidance or clarification. 86