366+31+1 = 398 days
It equals one leap year + one month + "a little room to handle the messiness of dates."
In 2017, Ballot 185 initially proposed a new limit of 12 months, then expanded it to 13 months, or 398 days.
jeremy.rowley at digicert.com:
I like the concept of shorter validity periods, but I’d suggest a 13 month validity period rather than 12. That way subscribers can renew annually with a one month buffer period.
andrew at sslmate.com:
To avoid the expiration date drifting every year, a renewed
certificate's notAfter date must be exactly one year after the current
certificate's notAfter date. With a 12 month limit, the CA could only
do this by issuing the renewed certificate exactly when the current
certificate expires, which is clearly unworkable since it allows no
time for cutover.
In contrast, a 13 month limit would allow a CA to issue the renewed
certificate up to one month before the current certificate expires,
with a validity period between 12 and 13 months as necessary to make
the expiration date sync up. This is far friendlier.
pzb at amzn.com:
As people are drafting ballots, can you please consider specifying intervals in days and using the maximum case for the interval (assuming leap years, long months, leap seconds, rounding etc)? For example, if you want to specify 13 months, please consider using 366 + 31 + 1 = 398 days.
sleevi at google.com:
- Changed 12 months to 398 days, following the recommendation in
https://cabforum.org/pipermail/public/2017-February/009449.html
There was some bikeshedding over whether Ballot 185 should make the limit 398 versus 400 days. Ballot 185 failed, and instead the 825-day limit Ballot 193 passed. In 2019 a 398-day limit was re-proposed in Ballot SC22.
sleevi at google.com:
- The choice of 397 days represents the maximum legitimate interpretation
of a "thirteen-month" period; it's calculated from 366 days (considering
leap years) along with a 31-day month, the longest in the calendar used by
certificates.
cspann at apple.com:
Apple is supportive of this proposal and will endorse it with some additional clarification in an implementation note or some other addressing of the issue of the partial day ambiguity.
sleevi at google.com:
I've been thinking about how to bring that clarity, and I'm curious if the
following would address the concern:
- Define the maximum Validity Period as 398 days, rather than 397
- Change the requirements around validity period to say that CAs SHOULD NOT
issue certificates with Validity Periods greater than 34300800 seconds,
which is 397 days of 86,400 seconds, and MUST NOT issue certificate with
Validity Periods greater than 34387200 seconds, which is 398 days of 86,400
seconds.
- This attempts to define validity periods unambiguously in number of
seconds
- But to allow for leap seconds, time zone changes, and 'reasonable'
mistakes, sets the MUST NOT at 398 days. Any CA that implements their
system using 397 days correctly will be hard pressed to violate the MUST
NOT, but that gives a little room to handle the messiness of dates.
https://github.com/cabforum/documents/pull/138/commits/b74a038cc492e1ba4f087e7db94494e99f609070
Update BRs with feedback from Apple
* Avoid ambiguity as to days by defining in seconds
* Increase to 398 days as the MUST NOT, while 397 as the SHOULD NOT, to hopefully guide CAs into correct implementation
Ballot SC22 failed, but it was adopted as that new requirement by Apple:
TLS server certificates issued on or after September 1, 2020 00:00 GMT/UTC must not have a validity period greater than 398 days.
- 398 days is measured with a day being equal to 86,400 seconds. Any time greater than this indicates an additional day of validity.
- We recommend that certificates be issued with a maximum validity of 397 days.
That 398-day requirement and 397-day recommendation was then later included in Ballot SC31, which (after a great, great deal of struggle) ultimately passed.
Subscriber Certificates issued on or after 1 September 2020 SHOULD NOT have a Validity Period greater than 397 days and MUST NOT have a Validity Period greater than 398 days.