64-Day Certificates Are Coming: Two Small Tweaks to Your Renewal Logic
Let's Encrypt is dropping certificate validity from 90 days to 64 days starting February 2027. If you're like me, your first thought was probably "64 days is still 64 days, what's the big deal?" The big deal is that a lot of renewal scripts make assumptions about timing that break when you compress the cycle. The Math Problem With 90-day certs, certbot's default 30-day renewal window meant…
Starting February 2027, Let's Encrypt will reduce certificate validity from 90 days to 64 days. While 64 days still equates to 64 days, the reduced cycle length can cause issues with renewal scripts that rely on certain timing assumptions. Many renewal scripts are hardcoded to check 30 days before expiry, which provided a comfortable 30-day buffer. With 64-day certificates, renewing at the same 30-day window would only give a 4-day overlap, increasing the risk of a failed renewal.
To address this, one approach is to calculate the renewal window as a percentage of the certificate's lifetime. By determining the cert's lifetime in seconds and setting a renewal threshold at 70% of that duration, the renewal process becomes adaptable to changes in certificate validity period. This method works for any certificate duration, not just 64 days.
Another point to consider is monitoring. Many monitoring tools check days until expiry against a static threshold. With the reduction to 64-day certificates and a tighter renewal window, alerting at 30 days may not be sufficient. Adjusting the alert threshold to around 15 days could provide enough time to detect and resolve any renewal failures before the certificate actually expires. Reviewing and possibly updating alerting configurations is essential to ensure continued monitoring effectiveness.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
