Let’s Encrypt Shortens Default TLS Certs to 64 Days

Let’s Encrypt will shorten the default validity of its free TLS certificates from 90 days to 64 days starting February 10, 2027, marking a major step toward an eventual 45-day maximum lifetime planned for 2028^[1][2][3][6]. The nonprofit certificate authority, which secures millions of websites worldwide, says the change is designed to align with upcoming industry rules and push the ecosystem further toward fully automated certificate management^[1][3][13].

Under the new policy, any certificate issued or renewed with Let’s Encrypt’s classic ACME profile on or after February 10, 2027 will be valid for 64 days, while existing 90-day certificates will remain trusted until they expire naturally, with the last such certificate expected to lapse on May 11, 2027^[1][2][8][9]. Organizations that want to move faster can already opt into a tlsserver profile issuing 45‑day certificates, and a short‑lived profile offering 6‑day certificates remains available for high‑security use cases^[2][6][12]. The classic profile is scheduled to drop further to 45‑day certificates on February 16, 2028, at which point domain authorization reuse will shrink to roughly seven hours, tightening the window for reusing previous validations^[2][6][15].

Let’s Encrypt emphasizes that the shift is driven primarily by changes in the CA/Browser Forum Baseline Requirements, which will cap publicly trusted TLS certificate lifetimes at 47 days starting March 15, 2029^[3]. Moving to 45‑day lifetimes ahead of that deadline gives the CA room to absorb operational variance while limiting the impact of mis‑issuance and key compromise, since any problematic certificate will naturally age out more quickly^[3][4]. The organization has long argued that shorter lifetimes are safer and has historically issued 90‑day certificates to encourage automation rather than manual, calendar‑based renewal routines^[3][15].

Operationally, shorter lifetimes will significantly increase the frequency of renewals across Let’s Encrypt’s ecosystem. The CA estimates that moving from 90‑day to 45‑day certificates will roughly double the number of renewal requests, since many users currently renew around day 60 and will in future need to renew around day 30^[4]. To help subscribers prepare, Let’s Encrypt plans to enable 64‑day certificates in its staging environment on October 14, 2026, allowing administrators and ACME client developers to test the change against their workflows before it hits production^[1][7][10]. ACME clients that support the Automated Renewal Information (ARI) extension can dynamically adjust renewal timing based on signals from the CA, reducing the risk of synchronized spikes and failed renewals^[4].

The move will force organizations that still rely on fixed renewal schedules to revisit long‑standing assumptions. Common renewal intervals such as “83 days,” “80 days,” or “60 days,” which were often used with 90‑day certificates, will no longer be appropriate once 64‑day lifetimes become the default^[5]. Guidance from Let’s Encrypt and industry commentators stresses the need to audit ACME clients, verify ARI support, and ensure that certificate‑expiration monitoring and alerting are in place so that missed renewals do not silently lead to outages^[4][5][12]. Large hosting providers and CDNs, in particular, are being urged to test at scale against the staging environment and confirm that rate‑limit and caching strategies can accommodate more frequent renewals^[4][5].

Although the update is not tied to any specific vulnerability or exploitation campaign, it reflects a broader tightening of trust practices across the public PKI ecosystem^[3][15]. Shorter lifetimes reduce reliance on emergency revocation during incidents and make it easier for browser and platform vendors to respond quickly to systemic issues, since problematic certificates fall out of circulation faster^[3][4]. For security teams, the real risk lies not in the new validity period itself but in failing to modernize certificate operations: organizations that have not fully automated issuance and renewal may find the 64‑day default, and the coming 45‑day cap, expose brittle manual processes that were previously masked by longer lifetimes^[3][4][15].

References

1. letsencrypt.org › 2026/10/07 › 64-day-certs64-Day Certificate Lifetimes Coming Feb 2027 – Let’s Encrypt
2. Decreasing Certificate Lifetimes to 45 Days – Let’s Encrypt
3. Certificate Lifetime Rationale and Plans – Let’s Encrypt
4. Shorter Certificate Lifetimes and Rate Limits – Let’s Encrypt
5. Let’s Encryptが2027年2月から証明書の有効期間を64日間に短縮 – ライブドアニュース
6. Upcoming Features – Let’s Encrypt
7. Let’s Encrypt will shorten the validity period of certificates to …
8. Let’s Encrypt announces 64-day TLS certificates from February 10, 2027
9. Let’s Encrypt is slashing certificate lifetimes to just 64 days
10. Let’s Encrypt to introduce 64-day certificates in February 2027 — Ars Technica
12. Let’s Encrypt is moving to 45-day certificates before everyone else
13. lwn.net › Articles › 1099588Let’s Encrypt moving to 64-day certificate lifetimes in 2027
15. cybersecuritynews.com › lets-encrypt-45-daysLet’s Encrypt to Reduce Certificate Validity from 90 Days to …