---
title: "Policies with a grace period"
description: "Policies with a grace period in PKI SDK: the time allowed for a certificate's revocation to propagate, which makes validation more reliable."
canonical: "https://docs.lacunasoftware.com/en-us/articles/pki-sdk/signatures/policies/grace-period"
locale: "en"
product: "PKI SDK"
last_updated: "2026-10-12"
---

# Policies with a grace period

In validation there is an unavoidable delay between a certificate's revocation request and the distribution of the matching
revocation report. For more reliable signature validation, a **grace period** is recommended.

## Grace period

The grace period is the time expected for a certificate's revocation information to propagate through the Certification
Authority's internal process until it is published by the trusted parties.

From the validator's point of view, it is the shortest time it must wait before requesting a certificate's revocation status,
so that the responsible issuer has published it reliably.

When validating a signature with a trusted date, a mechanism that keeps the signature valid even after the signer's certificate
is revoked or expires, the validator must, before asserting the validity of this certificate, make sure the grace period lies
between the signature's date reference and the date of the revocation data used. This date reference can be a signature
timestamp (TST) or a time-mark from a trusted authority.

The length of the grace period, and whether the revocation values used must have been issued after it ends, are the
responsibility of the Certification Authority and must be stated in its Certification Practice Statement (CPS).

![Grace period](https://docs.lacunasoftware.com/images/pki-sdk/grace-period.png)

## Signing with a grace period

Signatures whose policy has a grace period can only be created with the asynchronous signature finishing strategy. For more
information, see [Asynchronous signature finishing](https://docs.lacunasoftware.com/en-us/articles/pki-sdk/signatures/cades/finisher).

To include a fixed grace period in the policy, use the @Lacuna.Pki.Cades.CadesPolicySpec.SetGracePeriod(System.TimeSpan) method,
as in the example below.

```cs
// Loading a signature policy
CadesPolicySpec policy = ...

// Setting a fixed grace period of 2 hours
policy.SetGracePeriod(TimeSpan.FromHours(2));
```

You can also use an @Lacuna.Pki.IGracePeriodCatalog, a grace period catalog that returns the length of the grace period based
on information of the signer's certificate, such as the Issuer or CertificatePolicies, and set it on the policy through the
@Lacuna.Pki.Cades.CadesPolicySpec.GracePeriodCatalog property.

```cs
// Implementation of a grace period catalog
IGracePeriodCatalog catalog = ...

policy.GracePeriodCatalog = catalog;
```

## See also

* [Asynchronous signature finishing](https://docs.lacunasoftware.com/en-us/articles/pki-sdk/signatures/cades/finisher)
* @Lacuna.Pki.Cades.BrazilCadesPolicySpec