{
  "id": 14744698,
  "title": "64-Day Certificates Are Coming: Two Small Tweaks to Your Renewal Logic",
  "url": "https://urgent.news/2026/10/15/64-day-certificates-are-coming-two-small-tweaks-to-your-renewal-logic",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-15T17:04:52.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/schiff_heimlich/64-day-certificates-are-coming-two-small-tweaks-to-your-renewal-logic-4nfm"
  },
  "original_language": "en",
  "account": "Starting February 2027, Let's Encrypt will reduce certificate validity from 90 days to 64 days. While 64 days still equates to 64 days, the reduced cycle length can cause issues with renewal scripts that rely on certain timing assumptions. Many renewal scripts are hardcoded to check 30 days before expiry, which provided a comfortable 30-day buffer. With 64-day certificates, renewing at the same 30-day window would only give a 4-day overlap, increasing the risk of a failed renewal.\n\nTo address this, one approach is to calculate the renewal window as a percentage of the certificate's lifetime. By determining the cert's lifetime in seconds and setting a renewal threshold at 70% of that duration, the renewal process becomes adaptable to changes in certificate validity period. This method works for any certificate duration, not just 64 days.\n\nAnother point to consider is monitoring. Many monitoring tools check days until expiry against a static threshold. With the reduction to 64-day certificates and a tighter renewal window, alerting at 30 days may not be sufficient. Adjusting the alert threshold to around 15 days could provide enough time to detect and resolve any renewal failures before the certificate actually expires. Reviewing and possibly updating alerting configurations is essential to ensure continued monitoring effectiveness.",
  "summary": "Let's Encrypt is dropping certificate validity from 90 days to 64 days starting February 2027. If you're like me, your first thought was probably \"64 days is still 64 days, what's the big deal?\" The big deal is that a lot of renewal scripts make assumptions about timing that break when you compress the cycle. The Math Problem With 90-day certs, certbot's default 30-day renewal window meant…",
  "key_points": [
    "Let's Encrypt reducing certificate validity to 64 days from February 2027.",
    "Renewal scripts may fail with hardcoded 30-day check before expiry.",
    "Adjust renewal threshold to 70% of certificate lifetime or monitor at 15 days."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}