Let's Encrypt Goes to 64-Day Certificates: When Does Your ACME Client Actually Renew?
On 10 February 2027, Let's Encrypt will begin issuing 64-day SSL certificates by default, reducing from 90 days. The change will continue towards 45-day certificates in 2028. A watcher observed the first 64-day certificate arrive at 21:35 UTC. Five ACME client installations were tested, including certbot, acme.sh, and lego, on a test server.
The clients scheduled renewals at the two-thirds point of the certificate's lifetime, which was 21 to 22 days before expiration for the 64-day certificates, consistent with RFC 9773 recommendations.
Certbot 2.9.0, which does not support ARI, renewed its certificate at 34.08 days (just over one-third of the 64-day period), while acme.sh 3.0.7 scheduled renewal for day 59, five days before the certificate expired. Upgrading acme.sh to version 3.1.6 moved the renewal time to day 42, as expected. Lego 5.5.2, using the ARI window, renewed its certificate at 42.67 days, exactly two-thirds of the lifetime.
The study found that most clients follow the two-thirds renewal guideline, with a few exceptions like acme.sh 3.0.7, which scheduled renewal for day 59 (five days before expiration) and did not renew before the certificate expired.
Written by urgent.news from Lobsters's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
