[GH-ISSUE #588] Apple now requires certs must not have a validity period greater than 398 days. #331

New issue

Open

opened 2026-02-25 22:33:07 +03:00 by kerem · 2 comments

kerem commented

2026-02-25 22:33:07 +03:00

Owner

Originally created by @GeoTimber on GitHub (Jun 6, 2024).
Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/588

See https://support.apple.com/en-us/102028

Originally created by @GeoTimber on GitHub (Jun 6, 2024). Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/588 See https://support.apple.com/en-us/102028

kerem commented

2026-02-25 22:33:07 +03:00

Author

Owner

@FiloSottile commented on GitHub (Jun 6, 2024):

This change will affect only TLS server certificates issued from the Root CAs preinstalled with iOS, iPadOS, macOS, watchOS, and tvOS.

Do you have evidence of this affecting mkcert?

@FiloSottile commented on GitHub (Jun 6, 2024): > This change will affect only TLS server certificates issued from the Root CAs preinstalled with iOS, iPadOS, macOS, watchOS, and tvOS. Do you have evidence of this affecting mkcert?

kerem commented

2026-02-25 22:33:07 +03:00

Author

Owner

@GeoTimber commented on GitHub (Jun 7, 2024):

Good morning @FiloSottile

I thought I had evidence and then I wasnt so sure any more, that is why my first post here ended up being so very short, my apologies.

I just tested again on Ubuntu 22.04 (KDE NEON) on the master branch and issued a certificate within 398 days and a certificate leaving the expiry as in the last master commit ( 825 days ). Using nginx.

And tested both in IOS 12.4 and IOS 17.1, with the ROOTCA, ( expiry in 10 years ) properly installed

and both work here, so a none issue at the moment as the Apple requirement does not seem to be enforced at the moment.

Thanks for all the good work, un saludo Joris

@GeoTimber commented on GitHub (Jun 7, 2024): Good morning @FiloSottile I thought I had evidence and then I wasnt so sure any more, that is why my first post here ended up being so very short, my apologies. I just tested again on Ubuntu 22.04 (KDE NEON) on the master branch and issued a certificate within 398 days and a certificate leaving the expiry as in the last master commit ( 825 days ). Using nginx. And tested both in IOS 12.4 and IOS 17.1, with the ROOTCA, ( expiry in 10 years ) properly installed and both work here, so a none issue at the moment as the Apple requirement does not seem to be enforced at the moment. Thanks for all the good work, un saludo Joris