Cert Lifetime — TLS Cert Lifetime Lint

Six lines in this pipeline break TLS renewal, and they belong to the platform engineers running Terraform and cert-manager in production today.

This is what the extension prints for it, before a word of explanation:

pipeline.txt
  2: An RSA key under 2048 bits is being generated.
  3: openssl -days is over 200.
  6: Terraform validity_period_hours is over 4800 hours (200 days), the public TLS maximum in force since 2026-03-15.
  9: cert-manager duration is over 4800h (200 days).
  12: This expiry alert only fires with 21 days or less left.
  15: HTTP Public Key Pinning is being sent.
-- 6 --

Those six line numbers point at an ordinary renewal setup:

 1  # renew.sh
 2  openssl req -new -newkey rsa:1024 -nodes -keyout edge.key -out edge.csr
 3  openssl x509 -req -days 365 -in edge.csr -signkey edge.key -out edge.crt
 5  # edge.tf
 6    validity_period_hours = 8760
 8  # certificate.yaml
 9    duration: 8760h
11  # alerts.yaml
12    expr: cert_expiry_days < 14
14  # nginx.conf
15  add_header Public-Key-Pins 'pin-sha256="..."; max-age=5184000';

Nothing there looks wrong. It was all correct in 2024.

What changed, and on which dates

CA/Browser Forum ballot SC-081v3 passed in April 2025 and put the maximum lifetime of a publicly trusted TLS certificate on a fixed schedule. 200 days from 2026-03-15. 100 days from 2027-03-15. 47 days from 2029-03-15. Domain control validation reuse shrinks alongside it, down to 10 days by 2029.

The first step is behind us. The second, 2027-03-15, turns a six-monthly habit into an outage, because 100 days no longer fits inside any renewal cadence a human remembers to perform.

Reading the six lines

Lines 3, 6 and 9 all ask for a year, and a public CA will not issue a year. You get a refusal, or you get a shorter certificate than the manifest claims you have, which is worse: renewBefore is then computed against a lifetime that does not exist. Line 2 fails earlier still, at issuance rather than at deployment, because NIST SP 800-131A disallows RSA under 2048 bits.

Line 12 is the quiet one. Fourteen days of warning is generous against a 398-day certificate. Against a 100-day certificate, one third of the lifetime is 33 days, so that alert fires after the renewal window has already closed. Line 15 bites only at renewal: a pin set outlives a certificate re-keyed every 47 to 100 days, so the header locks visitors out of the site it was meant to protect.

What the extension does

TLS Cert Lifetime Lint carries the SC-081v3 schedule as 12 fixed rules rather than as recall. Alongside the six above it catches SHA-1 signing, which public CAs stopped doing in 2016, TLS 1.0 and 1.1, and the runbook line that still states the retired 398-day maximum. It reads openssl commands, Terraform, cert-manager YAML, nginx and Apache directives, Go tls.Config and Prometheus alert rules, and reports the line, the dated cap it breaks, and the value to use instead. What is already broken is separated from what breaks at the next milestone, so a backlog can be ordered rather than panicked over.

Checking a file you have open is free, and complete: every finding, every line number, nothing blurred and no trial counter. A licence adds the next job - the whole repository at once, the findings exported as CSV, JSON or HTML, and CI JSON so a pull request fails before an over-length certificate reaches production. An online SSL scanner tests a certificate that is already serving traffic, so it finds this after deployment; this reads the configuration before anything is issued.