Let's Encrypt will cut certificate lifetimes to 64 days

Let's Encrypt will begin issuing certificates with a 64-day lifetime by default on February 10, 2027, replacing the current 90-day default for new certificates and renewals. The certificate authority announced the change on October 7, saying the last 90-day certificates should expire around May 11, 2027.

The change is part of a wider move towards shorter certificate lifetimes. Let's Encrypt says it will reduce the default lifetime again to 45 days in 2028, while the authorisation reuse period will fall from 30 days to 10 days in February 2027 and then to seven hours in 2028.

What website operators need to know

The immediate impact depends on how certificate renewal is handled. Let's Encrypt says clients that support ACME Renewal Information, or ARI, should be able to use the certificate authority's guidance on when to renew. Operators relying on hard-coded renewal dates should instead move towards renewing at roughly two-thirds of the certificate's lifetime.

For a 64-day certificate, that means planning around day 43 rather than waiting for a fixed 60-day schedule. That margin matters because a renewal job can be delayed by DNS problems, an unavailable service or a broken deployment hook. The 2028 move to 45-day certificates would make a 60-day renewal schedule actively unsafe, as the certificate could expire before the job runs.

Let's Encrypt has already made 64-day certificates available in its staging environment for testing. Its announcement recommends using that environment before the production change arrives. The organisation also advises operators to review automation around certificate reloads, deployment and alerting, rather than assuming that a successful renewal request proves the new certificate is being served.

The change will not alter ACME endpoints or issuance chains, and Let's Encrypt says its rate limits will not be affected. Valid existing certificates will not be revoked as part of the transition. The security organisation says shorter lifetimes reduce the window for key compromise and mis-issuance.

Our opinion

This is mainly an automation deadline, not a reason to panic. Well-maintained ACME clients should handle the shorter lifetime, but organisations with cron jobs, runbooks or custom deployment scripts should test them now. The sensible benchmark is not whether a renewal succeeds once; it is whether renewal, installation, reload and alerting still work when the certificate has only a few weeks of validity left.