Let’s Encrypt TLS certificate lifetimes to drop from 90 to 64 days starting February 2027
Let’s Encrypt will issue 64-day TLS certificates by default from February 10, 2027, down from 90 days.
The Internet Security Research Group said Let’s Encrypt will issue TLS certificates valid for 64 days by default starting February 10, 2027, down from 90 days. The last 90-day certificate is expected to expire on May 11, 2027, and existing certificates will not be revoked. Staging issuance begins October 14, 2026. Authorization reuse also falls from 30 days to 10 days, ahead of 45-day lifetimes in 2028 and a seven-hour reuse limit.
- Default Let’s Encrypt lifetime falls from 90 to 64 days on February 10, 2027.
- Staging starts issuing 64-day certificates on October 14, 2026.
- ACME Renewal Info clients should renew automatically; hardcoded cron values need updates.
- Authorization reuse drops from 30 days to 10 days, then seven hours in 2028.
Full article357 words · extracted from helpnetsecurity.com · click to collapse
Websites that rely on Let’s Encrypt will soon have to renew their TLS certificates more often. Starting February 10, 2027, the certificate authority will issue certificates valid for 64 days by default, down from 90 days.
Subscribers who already use Let’s Encrypt’s optional 45-day or 6-day certificates are not affected.
The organization expects the last 90-day certificate to expire on May 11, 2027, and will not revoke any valid certificates during the transition.
Why the change
The move to shorter certificate lifetimes “reduces the risk of key compromise and mis-issuance,” said Sarah Gran of the Internet Security Research Group (ISRG), the nonprofit that runs Let’s Encrypt.
“As a nonprofit we see it as part of our mission to make this change to advance security for everyone using the Web globally,” Gran added.
The 64-day period prepares users for default lifetimes of 45 days in 2028.
What admins should check
Let’s Encrypt will start issuing 64-day certificates in its staging environment on October 14, 2026, and recommends testing there before the production switch.
Sites that automate renewals through a client supporting ACME Renewal Info (ARI) should not need to change anything, since ARI lets Let’s Encrypt tell the client when to renew. Admins can check their client’s documentation to confirm.
Setups that renew at a fixed number of days before expiration need updating. Let’s Encrypt advises renewing at about two thirds of a certificate’s lifetime and suggests searching cron jobs, wrapper scripts and runbooks for hardcoded values such as 83, 80 or 60.
Gran recommends automating certificate reload and deployment, and setting up alerts for failed renewals.
Let’s Encrypt is also cutting the authorization reuse period from 30 days to 10 days. In 2028, the period will drop to seven hours.
“We are making this change to comply with a 2029 reduction in maximum validation reuse periods, and to remove the need for “CAA rechecking”, where we have to repeat part of the validation process if the validation data is more than 7 hours old. Unless you have specifically designed your ACME client to rely on validation reuse, you will not need to make any changes,” concluded Gran.
Text extracted automatically; images, tables and formatting may be missing. Original: