What's the maximum AWS Private CA validity period that I can use when requesting a new private certificate?
I want to calculate the maximum validity period for an AWS Private Certificate Authority (AWS Private CA) certificate.
"I want to calculate the maximum validity period for an AWS Private Certificate Authority (AWS Private CA) certificate.ResolutionACM Private CA sets the "Not Before" date in the validity field to date and time minus 60 minutes. This compensates for time inconsistencies across systems of 60 minutes or less.You can calculate the maximum validity period by getting the epoch time format for the "NotAfter" date. Then, calculate the number of days between the time of issuing the end-entity certificate and the CA's expiration date.Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.1.    Run the AWS CLI command describe-certificate-authority similar to the following:aws acm-pca describe-certificate-authority --certificate-authority-arn arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-123456789012Example output:{  "CertificateAuthority": {    "Arn": "arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-123456789012",    "OwnerAccount": "123456789012",    "CreatedAt": "2019-10-22T19:26:52.721000+00:00",    "LastStateChangeAt": "2019-10-22T19:29:32.333000+00:00",    "Type": "SUBORDINATE",    "Serial": "4096",    "Status": "ACTIVE",    "NotBefore": "2019-10-22T18:29:30+00:00",    "NotAfter": "2029-10-22T19:29:30+00:00",    "CertificateAuthorityConfiguration": {      "KeyAlgorithm": "RSA_2048",      "SigningAlgorithm": "SHA256WITHRSA",      "Subject": {        "Country": "AU",        "Organization": "MINDEF/SAF",        "OrganizationalUnit": "AU",        "State": "Australia",        "CommonName": "example.com.au",        "Locality": "Australia"      }    },    "RevocationConfiguration": {      "CrlConfiguration": {        "Enabled": true,        "ExpirationInDays": 7,        "S3BucketName": "crl-123456789012-region",        "S3ObjectAcl": "PUBLIC_READ"      },      "OcspConfiguration": {        "Enabled": false      }    },    "KeyStorageSecurityStandard": "FIPS_140_2_LEVEL_3_OR_HIGHER"  }}2.    Calculate the number of days between the time of issuing the end-entity certificate and the CA's expiration date. You can use the days calculator on the Time and Date AS website. In this example, the end-entity certificate date is Tuesday, October 22, 2019 and the CA's expiration date is Monday, October 22, 2029.The result is 3252 days. The maximum number of days that you can put for --validity with the CA is 3251 days.Note: If you use a value equal to or more than 3252 days, then the AWS CLI command output returns a "ValidationException" error similar to the following:An error occurred (ValidationException) when calling the IssueCertificate operation: The certificate validity specified exceeds the certificate authority validity.For more information, see Managing the private CA lifecycle.Related informationHow can I request a private certificate using the ACM console when ACM-PCA validity period is less than 13 months?Follow"