Let's Encrypt will issue 64-day certificates by default from February 10, 2027

Let's Encrypt announced on October 7 that from February 10, 2027, every certificate it issues or renews will have a 64-day lifetime by default, unless the subscriber chooses an even shorter 45-day or 6-day option. It expects the last 90-day certificates to expire on May 11, 2027, and won't revoke valid certificates as part of the change. The move prepares for 45-day default lifetimes in 2028, in line with industry-wide requirements to shorten certificate validity, which reduces the risk from key compromise and mis-issuance.

The staging environment switches to 64-day certificates on October 14, 2026, and Let's Encrypt recommends testing there first. Subscribers whose ACME clients support ACME Renewal Info (ARI) should be fine, because the CA can tell the client when to renew. Anyone with renewals hard-coded to a date before expiry should change them to renew at roughly two-thirds of the lifetime; Let's Encrypt suggests grepping cron jobs and scripts for common values like 83, 80 or 60.

The CA will also cut its authorization reuse period from 30 days to 10 days, and to seven hours in 2028, to comply with a 2029 limit on validation reuse. Rate limits, ACME endpoints and issuance chains are unaffected.