Let’s Encrypt TLS certificate lifetimes to drop from 90 to 64 days starting February 2027

Websites that rely on Let’s Encrypt will soon have to renew their TLS certificates more often. Starting February 10, 2027, the certificate authority will issue certificates valid for 64 days by default, down from 90 days.

Subscribers who already use Let’s Encrypt’s optional 45-day or 6-day certificates are not affected.

The organization expects the last 90-day certificate to expire on May 11, 2027, and will not revoke any valid certificates during the transition.

Why the change

The move to shorter certificate lifetimes “reduces the risk of key compromise and mis-issuance,” said Sarah Gran of the Internet Security Research Group (ISRG), the nonprofit that runs Let’s Encrypt.

“As a nonprofit we see it as part of our mission to make this change to advance security for everyone using the Web globally,” Gran added.

The 64-day period prepares users for default lifetimes of 45 days in 2028.

What admins should check

Let’s Encrypt will start issuing 64-day certificates in its staging environment on October 14, 2026, and recommends testing there before the production switch.

Sites that automate renewals through a client supporting ACME Renewal Info (ARI) should not need to change anything, since ARI lets Let’s Encrypt tell the client when to renew. Admins can check their client’s documentation to confirm.

Setups that renew at a fixed number of days before expiration need updating. Let’s Encrypt advises renewing at about two thirds of a certificate’s lifetime and suggests searching cron jobs, wrapper scripts and runbooks for hardcoded values such as 83, 80 or 60.

Gran recommends automating certificate reload and deployment, and setting up alerts for failed renewals.

Let’s Encrypt is also cutting the authorization reuse period from 30 days to 10 days. In 2028, the period will drop to seven hours.

“We are making this change to comply with a 2029 reduction in maximum validation reuse periods, and to remove the need for “CAA rechecking”, where we have to repeat part of the validation process if the validation data is more than 7 hours old. Unless you have specifically designed your ACME client to rely on validation reuse, you will not need to make any changes,” concluded Gran.