Let's Encrypt certificates drop to 64 days in February
On Oct 7, Let's Encrypt announced the default certificate lifetime moves from 90 days to 64 days for every certificate issued or renewed on or after Feb 10, 2027. Staging started issuing 64-day certificates today, Oct 14, 2026. The last 90-day certificate should expire May 11, 2027. Nothing is being revoked as part of the transition.
What changed
- Feb 10, 2027: the default ACME profile issues 64-day certificates. Shorter options already exist for anyone who wants them: 45-day and 6-day profiles.
- Oct 14, 2026: the staging environment switches to 64-day issuance so operators can test their renewal setups before the production change.
- Authorization reuse drops from 30 days to 10 days. In 2028 the defaults drop again to 45-day lifetimes with 7-hour authorization reuse, tracking the CA/Browser Forum baseline requirements as they tighten (a 47-day maximum by March 2029, per Scott Helme's writeup).
- ACME endpoints, issuance chains, and rate limits are not affected.
Why it matters
- The mechanism is the one Let's Encrypt used when it picked 90 days back in 2016: a shorter validity window shrinks how long a compromised key or misissued certificate stays usable, and it pushes the ecosystem off fixed renewal schedules toward automation.
- The escape hatch is ARI, ACME Renewal Information: the CA tells the client when to renew instead of the client guessing from the expiry date. If your ACME client supports ARI, Let's Encrypt says you are all set.
- For hardcoded renewals the fix is mechanical: grep cron jobs, wrapper scripts, and runbooks for fixed offsets (the announcement calls out 83, 80, and 60 days) and switch to renewing at roughly two-thirds of the certificate lifetime. That two-thirds rule also lays the groundwork for the 45-day default in 2028.
The catch
- Manual or fixed-offset renewals that work fine at 90 days will start producing expired certificates in February. The failure mode is silent until the first missed renewal.
- Clients built around 30-day authorization reuse will revalidate more often at 10 days, and again at 7 hours in 2028. Unless a client was specifically designed to rely on reuse, no change is needed, but the tighter window leaves less room for flaky validation pipelines.
- The concrete action is staging: point the renewal config at staging and watch a 64-day certificate actually renew, then confirm the service reloads it. Let's Encrypt frames this as the moment to also automate cert reload and deployment and add alerting on renewal failures.
- If your environment grew organically, certificate renewal is exactly the kind of hygiene worth inventorying: find every Let's Encrypt certificate, check which client renews it, and check whether that client speaks ARI.