---
title: "Limits"
description: "Validity bounds, quotas, rate limits and retention for Private CA."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Limits

## Validity and sizes

| Limit | Value |
| --- | --- |
| Root CA validity | 365 to 9,132 days (about 25 years); 3,650 by default |
| Subordinate CA validity | 365 to 3,653 days (about 10 years); 1,825 by default; never past its parent |
| Longest certificate a CA issues (`maxLeafValidityDays`) | 1 to 825 days; 90 by default; can only be shortened |
| Hierarchy depth inside EZGH | 3: root, intermediate, issuing |
| Names per certificate | 100 |
| Certificate start time | Backdated 5 minutes for clock skew |
| Export passphrase | 12 to 1,024 characters |
| Deletion window | 7 to 30 days; 30 by default |

## Quotas

| Quota | Default |
| --- | --- |
| Certificate authorities per project | 10 |
| ACME bindings per certificate authority | 50 |

See them, and what's used, in [Service quotas](/quotas). Creating past one answers
`quota_exceeded`.

## Rate limits

| Limit | Value |
| --- | --- |
| Issuance per CA | 50 per second, bursts of 200 |
| ACME requests per binding | 20 per second, bursts of 100 |
| CRL and OCSP requests per client address | 100 per second, bursts of 500 |

## Retention

| What | Kept |
| --- | --- |
| A key EZGH generated for a certificate | Until you forget it, delete the certificate, or 30 days after it expires |
| An issued certificate's record | Until a year after it expires |
| A revoked certificate on its CA's CRL | Until it expires |

Source: https://docs.ezghcloud.com/private-ca/limits/index.mdx