Certificate validity is the time window during which a digital certificate is trusted by browsers, servers, and other systems. Outside that period, the certificate should be rejected, even if its cryptographic keys still exist. Validity is defined by start and end dates embedded in the certificate and enforced by clients that check whether the certificate is current.
This matters because certificates are central to HTTPS, software signing, and identity verification. Shorter validity periods reduce the time a stolen, misissued, or poorly managed certificate can be abused, which helps limit attacker options. The tradeoff is operational: organizations must renew and deploy certificates reliably, usually through automation and monitoring. In real defenses, certificate validity is tracked by inventory tools, renewal jobs, and alerting systems; in attacks, expired or revoked certificates may be used to cause outages, while compromised valid certificates can still support impersonation until they age out or are replaced.