64-Day Certificate Lifetimes Coming Feb 2027

Starting February 10, 2027, Let's Encrypt will issue and renew all certificates with a 64-day validity period by default. Subscribers can choose shorter lifetimes of 45 or 6 days. The last 90-day certificate is expected to expire on May 11, 2027, and no valid certificates will be revoked during the transition. The organization will test the change in its staging environment starting October 14, 2026.

For automated renewals, clients supporting ACME Renewal Information (ARI) should remain unaffected. Those with hard-coded expiration dates should adjust renewals to occur around two-thirds through the 64-day period. In 2028, Let's Encrypt will further reduce default lifetimes to 45 days and authorization reuse periods to 10 days, ultimately shrinking the reuse period to just seven hours in 2028.

This shift aims to minimize the risk of key compromise and mis-issuance, aligning with the nonprofit's mission to enhance web security globally.