{"id":599,"date":"2017-03-01T09:54:00","date_gmt":"2017-03-01T09:54:00","guid":{"rendered":"https:\/\/www.sslrenewals.com\/blog\/?p=599"},"modified":"2021-11-25T08:34:41","modified_gmt":"2021-11-25T08:34:41","slug":"why-ssl-certificates-expiration-dates","status":"publish","type":"post","link":"https:\/\/sslrenewals.com\/blog\/why-ssl-certificates-expiration-dates","title":{"rendered":"Why Do SSL Certificates Have Expiration Dates?"},"content":{"rendered":"

Decoding the SSL expiration, one of the essential things you should know about SSL Certificate<\/h2>\n

It\u2019s a question we get all the time: why do SSL certificates expire?<\/p>\n

Seriously, all the time. Especially at a site with a name like SSLRenewals.com. \u2018Why do I have to renew this?\u2019<\/em> Or \u2018Is this some kind of racket?\u2019<\/em>\u00a0<\/em><\/p>\n

No, it\u2019s not a racket or a scam, it\u2019s actually for a couple of very good reasons\u2014but we certainly understand why it would look that way.<\/p>\n

After all, SSL isn\u2019t perishable. It\u2019s not like a carton of milk or a loaf of bread\u2014it\u2019s not going to go bad, per se. But there are still good reasons for restricting the lifespan of SSL certificate\u2014two of them actually.<\/p>\n

\"SSL<\/p>\n

Let\u2019s take a look:<\/p>\n

Reason #1: For Identification Purposes<\/h3>\n

One of the best metaphors for SSL is a passport or a driver\u2019s license, for the sake of this exercise, we\u2019ll go with the driver\u2019s license. A driver\u2019s license and an SSL certificate serve two primary functions. On the one hand, a driver\u2019s license provides you access to the roads and grants you the ability to drive on them. SSL facilitates encryption via the SSL protocol, it basically gives you permission to use secure connections. One is a vehicle in transit; one is data in transit\u2014hey, let\u2019s not try to go too deep into this metaphor.<\/p>\n

The other function they both serve is to authenticate identity. And the issuing agency \u2013 the DMV or the Certificate Authority (CA) \u2013 occasionally need you to come back and check in so they can keep up to date information about you on record.<\/p>\n

That\u2019s especially important in the realm of cybersecurity. By default, the browsers that we use to navigate the web don\u2019t trust individual websites. Browsers are designed to keep users safe and by virtue of that, they\u2019re skeptical of everything and everyone. In order for a browser to trust a website, it needs to see that is has been authenticated by a trusted third party.<\/p>\n

CAs represent that trusted third party. To be a trusted CA, you have to abide by rigorous standards set forth by the CA\/Browser forum \u2013 which acts as the regulatory body for the industry \u2013 and any mistakes the CA makes can and will be used against it. That means that it\u2019s in the CA\u2019s best interest to keep up-to-date information on the sites it issues too because, for all intents and purposes, they\u2019re vouching for those sites\u2019 identities.<\/p>\n

By making you renew at least every two years the CA can ensure that it has accurate identifying information on the company or organization it\u2019s issuing to, in addition to making sure that the company still owns the registered domain. After all, domains change hands all the time.<\/p>\n

Expirations and renewals just allow for good security hygiene on the part of the CAs. Not to mention\u2026<\/p>\n

Reason #2: Expiration Allows SSL Encryption Technology to Advance<\/h3>\n

\"SSL<\/p>\n

The other reason SSL certificates need to expire is technical. Advances are being made on a regular basis with regards to the SSL\/TLS protocol and encryption technology in general. In the coming months, the SHA-1 hashing algorithm will be completely deprecated and TLS 1.3 will be released.<\/p>\n

That\u2019s two MAJOR changes. SHA-1 has been known to be vulnerable for years and has been replaced by the more secure SHA-2 algorithm. TLS 1.3 is a completely new version of the TLS protocol. In order to be as secure as possible, SSL needs to be implemented with SHA-2 encryption and TLS 1.3.<\/p>\n

Now think about what would happen if SSL certificates never expired. Yes, granted, it would be possible to update by re-issuing your certificate, but let\u2019s be honest\u2014a lot of companies and organizations install their SSL certificate once and leave it alone until it expires.<\/p>\n

So, SSL that didn\u2019t expire, or even SSL with validity periods of longer than two years (you used to be able to get up to five years), would eventually become insecure. Old, outdated ciphers, outmoded hashing algorithms, and other implementation issues would be commonplace. The SSL ecosystem as a whole would be a mish-mash of capabilities, as sites with newer certificates would be substantially more secure than sites with older ones.<\/p>\n

Eventually, it would get to a point where the browsers would start removing support for various outmoded features and valid SSL certificates would be rendered useless because they could no longer make secure connections.<\/p>\n

Having SSL certificates expire<\/a> avoids all of that. By requiring everyone to purchase a new certificate at least once every two years, it forces sites to continually adapt the newest, most secure technology.<\/p>\n

Expiration literally keeps you safer.<\/p>\n\n\n

Related Post<\/strong><\/p>\n\n\n\n