Let's Encrypt to cut default certificate lifetime to 64 days from February 2027

Let's Encrypt, the nonprofit certificate authority that issues free TLS certificates for a large share of the web, will shorten the default lifetime of its certificates from 90 days to 64 days starting February 10, 2027, according to Help Net Security. The change is an interim step before the default falls to 45 days in 2028, and it means administrators who rely on hardcoded renewal schedules risk certificate expiry and site outages if they do not adjust their automation.

What happened

According to Help Net Security, Let's Encrypt will begin issuing 64-day certificates in its staging environment on October 14, 2026, so that users can test their setups. The new lifetime becomes the production default on February 10, 2027. The last 90-day certificate is expected to expire around May 11, 2027, and Let's Encrypt said it will not revoke valid certificates during the transition.

Sarah Gran of the Internet Security Research Group (ISRG), which runs Let's Encrypt, said shorter lifetimes reduce the risk of key compromise and mis-issuance, Help Net Security reported. Subscribers who already use the optional 45-day or 6-day certificates are not affected.

Technical details

Alongside the lifetime change, Let's Encrypt is reducing the authorization reuse period, the window in which a previous domain validation can be reused, from 30 days to 10 days, Help Net Security said. The change responds to a planned 2029 reduction in maximum validation reuse periods and removes the need for so-called CAA rechecking when validation data is more than seven hours old. The authorization reuse period will fall again to seven hours in 2028. According to Gran, most users will not need changes unless their ACME client is designed to rely on validation reuse.

Who is affected

Sites using an ACME client that supports ACME Renewal Info (ARI) should need no changes, because Let's Encrypt tells the client when to renew. Setups that renew a fixed number of days before expiration, for example through cron jobs or wrapper scripts, will need to be updated, Help Net Security reported.

What to do

• Check whether your ACME client supports ARI and confirm its behavior in the client's documentation.
• Search cron jobs, wrapper scripts and runbooks for hardcoded renewal values such as 83, 80 or 60 days.
• Following Let's Encrypt's advice, renew at about two-thirds of the certificate's lifetime instead of a fixed day count.
• Test against the staging environment once 64-day certificates are available there on October 14.
• Automate certificate reload and deployment, and set up alerts for failed renewals.