General Information ID : INFO2222
Effective April 1, 2015, the CA/B Forum is reducing the maximum validity of OV and DV SSL certificates to 39 months in order to increase SSL/TLS security. Under these guidelines, no CA's or their partners should offer greater than 3-year validity term OV/DV SSL certificates effective April 1, 2015. As of March 9th, 2015 Symantec will only sell a maximum of 3-year OV (Organization Validated) and DV (Domain Validated) SSL certificates. This restriction applies to new certificate issuance as well as renewals. Starting April 1, 2015, if you need to re-issue your SSL certificate, the maximum validity allowed will be 39 months.
If the maximum validity is 3 years why is the restriction 39 months? When renewing a certificate you can receive up to a maximum of 3 months additional validity added to your certificate depending on the remaining time on your current certificate. If you renew early enough you will get a certificate valid for 39 months.
Can I still purchase 4 year SSL Certificates? You can purchase 4 year certificates up to March 9th, 2015. After this date the maximum duration will be 3 years.
Can I re-issue a 4 year SSL certificate? All certificates come with unlimited re-issues/replacements. However if you re-issue your certificate starting April 1st, 2015 and it has more than 39 months remaining then the validity will be truncated to 39 months. If you have 4 year certificates ensure you back-up the keys to prevent the need to re-issue and losing any validity period over 39 months.
Can I re-issue a certificate that is older than 39 months? The CA/B Forum has also stated that the 39 month restriction applies to vetted data. This means if you order a 4 year certificate you will only be able to re-issue/replace it during the first 39 months (and with a validity period of no more than 39 months). SSL Certificates are to be restricted to 3 Year Validity from April 1st, 2015.
What is the maximum validity period for EV certificates? This remains at 27 months, 24 months plus up to 3 months extra for early renewals.
Where can I find out more information about the CA/B Forum Guidelines? For the current CA/Browser Baseline Requirements, please visit https://cabforum.org/documents/ (see Section 9.4 in Baseline Requirements for validity period changes).