A method comprising: obtaining, at data processing hardware, from a root certificate authority, a root digital certificate digitally signed by the root certificate authority; generating, by the data processing hardware, a chain of intermediate certificate authorities, each respective intermediate certificate authority in the chain of intermediate certificate authorities comprising: a respective intermediate certificate digitally signed by the intermediate certificate authority or the root certificate authority that is immediately higher in the chain of intermediate certificate authorities than the respective intermediate certificate authority; and a respective validation time period indicating a range of times when the respective intermediate certificate authority is permitted to digitally sign intermediate certificates and end entity certificates, the respective validation time period of the respective intermediate certificate authority including the validation time period of each intermediate certificate authority that is lower in the chain of intermediate certificate authorities than the respective intermediate certificate authority; generating, by the data processing hardware, a certificate revocation list for the chain of intermediate certificate authorities; generating, by the data processing hardware, from the lowest intermediate certificate authority in the chain of intermediate certificate authorities, a plurality of end entity certificates, each end entity certificate of the plurality of end entity certificates digitally signed by the lowest intermediate certificate authority in the chain of intermediate certificate authorities; and after the respective validation time period of the lowest intermediate certificate authority in the chain of intermediate certificate authorities has elapsed, adding, by the data processing hardware, to the certificate revocation list, one or more of the plurality of end entity certificates generated from the lowest intermediate certificate authority in the chain of intermediate certificate authorities. obtaining, at data processing hardware, from a root certificate authority, a root digital certificate digitally signed by the root certificate authority; generating, by the data processing hardware, a chain of intermediate certificate authorities, each respective intermediate certificate authority in the chain of intermediate certificate authorities comprising: a respective intermediate certificate digitally signed by the intermediate certificate authority or the root certificate authority that is immediately higher in the chain of intermediate certificate authorities than the respective intermediate certificate authority; and a respective validation time period indicating a range of times when the respective intermediate certificate authority is permitted to digitally sign intermediate certificates and end entity certificates, the respective validation time period of the respective intermediate certificate authority including the validation time period of each intermediate certificate authority that is lower in the chain of intermediate certificate authorities than the respective intermediate certificate authority; a respective intermediate certificate digitally signed by the intermediate certificate authority or the root certificate authority that is immediately higher in the chain of intermediate certificate authorities than the respective intermediate certificate authority; and a respective validation time period indicating a range of times when the respective intermediate certificate authority is permitted to digitally sign intermediate certificates and end entity certificates, the respective validation time period of the respective intermediate certificate authority including the validation time period of each intermediate certificate authority that is lower in the chain of intermediate certificate authorities than the respective intermediate certificate authority; generating, by the data processing hardware, a certificate revocation list for the chain of intermediate certificate authorities; generating, by the data processing hardware, from the lowest intermediate certificate authority in the chain of intermediate certificate authorities, a plurality of end entity certificates, each end entity certificate of the plurality of end entity certificates digitally signed by the lowest intermediate certificate authority in the chain of intermediate certificate authorities; and after the respective validation time period of the lowest intermediate certificate authority in the chain of intermediate certificate authorities has elapsed, adding, by the data processing hardware, to the certificate revocation list, one or more of the plurality of end entity certificates generated from the lowest intermediate certificate authority in the chain of intermediate certificate authorities.