Let’s Encrypt will make 64 days the default lifetime for its certificates from February 10, 2027, down from 90, according to the certificate authority’s October 7 announcement.
What changes and when
Any certificate issued or renewed on or after February 10, 2027 gets 64-day validity, unless the subscriber picks a shorter option of 45 or 6 days. Let’s Encrypt starts issuing 64-day certificates in its staging environment on October 14, 2026, and expects the last 90-day certificate to expire on May 11, 2027. It says it will not revoke valid certificates as part of the change, and that ACME endpoints, issuance chains and rate limits are unaffected.
What operators need to do
Let’s Encrypt recommends testing in staging first. Clients that support ACME Renewal Information (ARI) should adapt on their own, because the certificate authority tells the client when to renew. Clients that renew on a hardcoded schedule should move to renewing about two-thirds of the way through a certificate’s lifetime, and the announcement suggests searching cron jobs, scripts and runbooks for hardcoded renewal values. It also recommends automating reload and deployment and alerting on renewal failures.
Why it matters
Let’s Encrypt says shorter lifetimes reduce the risk of key compromise and mis-issuance. For security teams the practical effect is a smaller margin for forgotten renewal jobs. Two-thirds of 64 days is about 43 days, so a job tuned to the old 90-day rhythm has less time to fail and be noticed before expiry.
In our reading, the certificates most likely to lapse first sit on appliances, internal tools and parked domains that nobody has touched since the renewal job was written. Our opinion piece on watching Certificate Transparency for every domain you own covers the monitoring side, and the case for an exposure inventory covers knowing which hosts hold certificates in the first place.
Source: Let’s Encrypt
