TLS certificates from Let’s Encrypt are about to get shorter-lived, so site operators will renew far more often.
Come February 10, 2027, the certificate authority plans to make 64 days the standard validity, narrowing the current 90-day span. Subscribers who already chose the optional 45-day or 6-day products see no change. Let’s Encrypt figures its last 90-day certificate will lapse on May 11, 2027, and pledges to leave valid certificates alone meanwhile.
Sarah Gran of the Internet Security Research Group, the nonprofit behind Let’s Encrypt, said the shorter span “reduces the risk of key compromise and mis-issuance,” and called it part of the group’s mission to advance security for everyone on the Web. The 64-day default also lays groundwork for 45-day certificates slated for 2028.
Testing of the new lifetime begins in Let’s Encrypt’s staging environment on October 14, 2026, and the group advises trying it there before production switches over. Where renewals are driven by a client that supports ACME Renewal Info, nothing should need changing, since ARI lets Let’s Encrypt dictate the renewal moment. Operators can confirm that support in the documentation. Trouble lies ahead for any setup that counts a set number of days backward from expiry rather than asking the client.
Renewal at roughly two thirds of a lifetime is the group’s own recommendation. Values like 83, 80 or 60 hardcoded somewhere betray a script still using the old math, so it urges administrators to sweep runbooks, wrapper scripts and cron jobs for them. Failed renewals, Gran said, deserve alerts, and the reload and deployment steps belong to automation. Separately, the authorization reuse window narrows from 30 days to 10 days, then to seven hours in 2028, a step tied to a 2029 cap on validation reuse that also retires “CAA rechecking.”
