Let’s Encrypt to Default to 64-Day Certificates in 2027 Ahead of 45-Day Plan
Summary
Let’s Encrypt will issue 64-day certificates by default starting February 10, 2027, ahead of planned 45-day certificates in 2028. It is testing the change and advises customers to check renewal automation.
Key points
- Newly issued or renewed Let’s Encrypt certificates will have 64-day lifetimes by default from February 10, 2027.
- The CA plans to move to 45-day certificate lifetimes in 2028; the last 90-day certificate is expected to expire May 11, 2027.
- Let’s Encrypt is testing 64-day certificates in its staging environment and recommends that customers test their renewal processes.
- Automated renewals using ACME Renewal Info (ARI) can receive renewal timing from Let’s Encrypt; fixed-date renewal schedules should be adjusted to about two-thirds of the certificate lifetime.
- Authorization reuse periods will fall to 10 days next year and seven hours in 2028, aligning with a planned 2029 maximum-reuse reduction and removing the need for CAA rechecking.
- The changes will not affect ACME endpoints, issuance chains, or rate limits.
Article Details
- Event Type
- Let’s Encrypt is reducing the default validity period of newly issued certificates to 64 days, ahead of a planned reduction to 45 days in 2028.
- Impact
- The change requires customers to test certificate renewal processes and adjust hardcoded renewal schedules where necessary. Let’s Encrypt says it will not affect ACME endpoints, issuance chains, or rate limits; shorter certificate lifetimes are expected to improve revocation efficiency and limit the scope of compromise.