Validity and sizes
| Limit | Value |
|---|---|
| Root CA validity | 365 to 9,132 days (about 25 years); 3,650 by default |
| Subordinate CA validity | 365 to 3,653 days (about 10 years); 1,825 by default; never past its parent |
Longest certificate a CA issues (maxLeafValidityDays) |
1 to 825 days; 90 by default; can only be shortened |
| Hierarchy depth inside EZGH | 3: root, intermediate, issuing |
| Names per certificate | 100 |
| Certificate start time | Backdated 5 minutes for clock skew |
| Export passphrase | 12 to 1,024 characters |
| Deletion window | 7 to 30 days; 30 by default |
Quotas
| Quota | Default |
|---|---|
| Certificate authorities per project | 10 |
| ACME bindings per certificate authority | 50 |
See them, and what’s used, in Service quotas. Creating past one answers
quota_exceeded.
Rate limits
| Limit | Value |
|---|---|
| Issuance per CA | 50 per second, bursts of 200 |
| ACME requests per binding | 20 per second, bursts of 100 |
| CRL and OCSP requests per client address | 100 per second, bursts of 500 |
Retention
| What | Kept |
|---|---|
| A key EZGH generated for a certificate | Until you forget it, delete the certificate, or 30 days after it expires |
| An issued certificate’s record | Until a year after it expires |
| A revoked certificate on its CA’s CRL | Until it expires |