Let's Encrypt to issue 64-day certificates by default starting February 10, 2027

Let's Encrypt, the free certificate authority that issues a large share of the web's TLS certificates, is shortening the default lifetime of its certificates. It will drop from 90 to 64 days on February 10, 2027. Announced on October 7 on the organization's blog, the change enters testing on October 14, 2026. From that date, the staging environment issues 64-day certificates.

The timeline

• October 14, 2026: 64-day certificates in the staging environment.
• February 10, 2027: every certificate issued or renewed with the default profile ("classic") is valid for 64 days, unless the subscriber chooses a shorter lifetime. They can opt for 45 days (the "tlsserver" profile, available since May 13, 2026) or 6 days (the "shortlived" profile).
• May 11, 2027: the last 90-day certificate is expected to expire. Let's Encrypt states that it will not revoke certificates that are still valid.
• February 16, 2028: switch to 45 days for the default profile, according to the schedule published in December 2025.

At the same time, the period during which a domain validation can be reused without a new check is being shortened. It goes from 30 to 10 days, then to 7 hours in 2028. For most users, this requires no changes, unless the ACME client (the software that obtains and renews certificates) relies on this reuse.

Why this change

Let's Encrypt says it wants to limit the risks of key compromise and mis-issuance. A short-lived certificate exposes a stolen key for a shorter time. The measure follows the Baseline Requirements of the CA/Browser Forum, the body that brings together certificate authorities and browser vendors. All public certificate authorities will make similar changes, according to Let's Encrypt, as quoted by SecurityWeek. Rate limits, ACME endpoints and certificate chains are not changing.

What to do

• Check that your ACME client supports ARI (ACME Renewal Info). With ARI, Let's Encrypt tells the client when to renew. This is the recommended setup.
• Hunt down hard-coded delays in cron jobs, scripts and procedures. Let's Encrypt cites values of 83, 80 or 60 days. Aim to renew at about two-thirds of the lifetime, or around day 43 for a 64-day certificate.
• Test on the staging environment starting October 14, before the switch in production.
• Automate deployment: web server reloads, and copying to load balancers or devices that receive their certificates manually.
• Set up an alert for renewal failures, so you don't discover the problem when the certificate expires.