You can issue a 15-year SSL certificate today. Why almost nobody does
2•panelica•35m ago
Most HTTPS deployments live in 90-day Let's Encrypt chunks. But for Cloudflare-proxied domains, there is a CA that issues 15-year certificates — here is the auto-issue pipeline that picks between Origin Cert, DNS-01 and HTTP-01 automatically.
Read More
https://panelica.com/blog/15-year-ssl-certificate-cloudflare-origin-implementation
Comments
gnabgib•33m ago
No.. you can't. 200 days is the max today. (Unless you're talking about a Private CA)
Expiry is optional on certificates. You can write your own using a library like OpenSSL and it will be respected by the browsers. What you linked to was an industry trade group voting on a bylaw.
gnabgib•1m ago
Have you ever seen a no-expiry cert? Widely criticized as a mistake. The null-object of TLS.
8organicbits•8m ago
Cloudflare origin CA is a private CA, so the CABF doesn't apply.
gnabgib•5m ago
Yes.. exactly.. you can't issue a 15y TLS (not SSL) cert today.. not in a usable way. If cloudflare stops proxying you, your cert is worth nothing (accepted by no one).
You can create your own without the use of cloudflare.. you can set it to a 100y expiry if you feel like it.
gnabgib•33m ago
https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-sch...
austin-cheney•14m ago
gnabgib•1m ago
8organicbits•8m ago
gnabgib•5m ago
You can create your own without the use of cloudflare.. you can set it to a 100y expiry if you feel like it.