What is Oracle's recommended expiration period for a public key certificate used in JWT creation?

• A. 180 days
• B. 365 days
• C. 730 days
• D. 2 years

Answer: (B)

Keep the certificate’s validity window reasonably short, but not so tight that it creates constant maintenance. Oracle’s guidance favors a 365-day expiration for a public key certificate used to sign JWTs because a one-year period provides a practical balance between security and operational overhead. A certificate that expires after a year limits the window of opportunity if a private key is compromised, while still being manageable to rotate and publish to relying parties (for example, via JWKS). When the certificate nears expiration, you rotate the key and update the public key distribution, ensuring JWT signatures can continue to be verified.

Longer lifetimes, like two years, raise risk by extending the period during which a compromised key could be used without detection. Shorter lifetimes, such as six months, add administrative burden without proportionally increasing security, given that you typically have other controls (token lifetimes, revocation mechanisms, etc.).