Certificate validity period

Every certificate carries a notBefore/notAfter window - typically one to three years for end-user certificates. The limit is deliberate: it caps the exposure of a key, forces periodic re-verification of the subject's data, and lets cryptography be refreshed as algorithms age. Outside that window (or after revocation) the certificate must not be trusted for new operations.

Expiry does not invalidate what was signed while the certificate was valid: with a qualified timestamp and LTV evidence, a signature remains verifiable decades after its certificate expired.