Certificate Validity Days Left
Classify an explicitly supplied certificate validity interval and calculate fractional days until notAfter using epoch milliseconds.
Description
A certificate's notBefore and notAfter values define its time-validity interval.
A certificate's notBefore and notAfter values define its time-validity interval. Checking that interval is one part of certificate validation and is distinct from authenticating its issuer, names or trust chain.1, 2
Classify an explicitly supplied certificate validity interval and calculate fractional days until notAfter using epoch milliseconds.
When to use Certificate Validity Days Left
Use this tool to classify an explicitly supplied certificate validity interval and calculate fractional days until notAfter using epoch milliseconds.
Choose the text, counts, explicit reference time or format parameters requested by this tool. Follow the stated byte, epoch-time and randomness assumptions.
How to use Certificate Validity Days Left and understand its results
- Choose the text, counts, explicit reference time or format parameters requested by this tool. Follow the stated byte, epoch-time and randomness assumptions.
- Enter notBefore, notAfter, now using the field table and calculation rules, then run the tool.
- Read status, daysLeft. The explanation below defines the units, signs, ordering and any flags or placeholder values.
- If the tool reports an input issue, correct the values and run it again. Apply the stated assumptions when interpreting a successfully returned result.
| Input field | Meaning | Value type; see rules below | Requirement |
|---|---|---|---|
| notBefore | Certificate start time | integer; minimum: -9007199254740991; maximum: 9007199254740991 | Required |
| notAfter | Certificate end time | integer; minimum: -9007199254740991; maximum: 9007199254740991 | Required |
| now | Reference time | integer; minimum: -9007199254740991; maximum: 9007199254740991 | Required |
Enter notBefore, notAfter and now as signed safe-integer epoch milliseconds. Reversed validity intervals are errors. Before the start, status is not-yet-valid; after the end it is expired; both endpoints are valid. Exact integer subtraction before conversion gives signed fractional days until notAfter, including zero at the endpoint.
daysLeft = (notAfter − now)/86,400,000; valid time interval is inclusive at both endpoints Units, indexing, boundary conditions and exceptional cases are defined in the calculation rules above.
| Output field | Meaning | Value type |
|---|---|---|
| status | Validity status | string; one of not-yet-valid, valid, expired |
| daysLeft | Fractional days until expiration | number |
{
"input": {
"notBefore": 0,
"notAfter": 259200000,
"now": 86400000
},
"output": {
"status": "valid",
"daysLeft": 2
}
}Limitations and assumptions
The tool receives timestamps rather than a certificate and does not parse ASN.1, verify signatures, check hostnames, revocation or trusted roots. It does not read the clock or add tolerance. Positive daysLeft can accompany a not-yet-valid status.
Numeric inputs must be finite. Follow the calculation-specific rules for overflow, underflow and exceptional cases. Missing required fields, extra fields, wrong value types and violations of the calculation rules are input errors.
Alternative or Complementary methods
Use JWT exp Days-Left Converter: Convert a supplied JWT exp NumericDate and reference NumericDate into signed fractional days remaining and expiry status. For a complementary task, use TOTP Step Remaining Seconds: Calculate the TOTP moving counter and whole seconds remaining in its current time step from explicit epoch seconds.
Further background: RFC 5280: certificate validity interval.
References
-
Certificate Validity Days Left — tool.io
-
RFC 5280: certificate validity interval — RFC Editor
Similar or alternative tools
- JWT exp Days-Left Converter
Convert a supplied JWT exp NumericDate and reference NumericDate into signed fractional days remaining and expiry status.
- TOTP Step Remaining Seconds
Calculate the TOTP moving counter and whole seconds remaining in its current time step from explicit epoch seconds.