Starting February 10, 2027, certificates from Let's Encrypt will be valid for 64 days by default instead of 90. The open certificate authority describes the move as a stepping stone to 45-day lifetimes, planned for 2028, according to SecurityWeek's coverage. Anyone whose renewals run on a fixed timetable has a few months to adjust.
The 64-day default does not replace the shorter 45-day or six-day profiles for subscribers who choose them.
Timeline for the switch
Every certificate newly issued or renewed on or after February 10, 2027 will carry the 64-day period. Certificates already issued with 90 days keep running until they lapse, and the last of them is expected to expire on May 11, 2027.
The 45-day target comes from a timeline Let's Encrypt published in a December 2025 blog post, as SecurityWeek reports. The 64-day phase sits between today's default and that goal.
The security argument
Let's Encrypt presents the shorter period as consistent with the CA/Browser Forum Baseline Requirements. The expected benefits are more efficient revocation and a narrower window in which a compromised certificate can be abused.
SecurityWeek also relays the CA's statement that every publicly trusted CA will make comparable changes.
Preparing renewals
Let's Encrypt will switch its staging environment to 64-day certificates on October 14, 2026, according to its official announcement. It recommends testing there before the production change.
How much work this involves depends on how renewals are triggered:
- Clients that support ACME Renewal Info (ARI): Let's Encrypt says automated renewals should need no changes, since ARI lets the CA tell the client when to renew. Its advice is to check the ACME client's documentation to see whether ARI is implemented.
- Renewals using fixed schedules: renew after approximately two-thirds of the certificate's lifetime have elapsed, rather than retaining a hard-coded interval designed for 90-day certificates.
The CA also recommends automating certificate deployment and reloads and adding alerts for failed renewals. Successful issuance alone does not replace deploying the renewed certificate to the service that uses it.
Authorization reuse drops further
A second change concerns how long a completed domain validation can be reused. Let's Encrypt says the authorization reuse period will fall to 10 days "next year" and to seven hours in 2028.
The CA gives two reasons. It wants to comply with a 2029 reduction in maximum validation reuse periods. It also wants to end "CAA rechecking," which forces it to redo part of validation when the validation data is more than seven hours old.
Let's Encrypt states that ACME endpoints, issuance chains and rate limits are not affected by the change.
