Key points
- Default certificate validity drops to 64 days on February 10, 2027.
- Authorization reuse periods shrink from 30 days to 10 days.
- ARI-enabled ACME clients require no configuration changes.
Let’s Encrypt will issue TLS certificates with a 64-day validity period by default starting February 10, 2027. This change replaces the current 90-day standard and requires system administrators to review their renewal automation. The Internet Security Research Group (ISRG), the nonprofit operating the service, states the reduction lowers the risk of key compromise and mis-issuance.
How it unfolded
- October 14, 2026: Let’s Encrypt begins issuing 64-day certificates in its staging environment for testing.
- February 10, 2027: The production environment switches to 64-day default validity for new certificates.
- May 11, 2027: The final 90-day certificates issued under the old policy are expected to expire.
- 2028: Default lifetimes will further reduce to 45 days, with authorization reuse dropping to seven hours.
Who is affected
Organizations relying on fixed-interval renewal schedules must update their configurations. According to Help Net Security, administrators should inspect cron jobs, wrapper scripts, and runbooks for hardcoded values such as 83, 80, or 60. Let’s Encrypt advises renewing at approximately two-thirds of a certificate’s lifetime. Subscribers already using optional 45-day or 6-day certificates are not affected by this specific change.
Sites utilizing ACME Renewal Info (ARI) support in their clients will likely experience no disruption. ARI allows the certificate authority to inform the client directly when renewal is required. Sarah Gran of ISRG stated that unless a client specifically relies on validation reuse, no changes are needed for the authorization reuse period reduction. The period drops from 30 days to 10 days to prepare for 2029 standards.
What happens next
The transition aims to align with future security requirements. The reduction in authorization reuse periods removes the need for CAA rechecking when validation data exceeds seven hours of age. Let’s Encrypt will not revoke any currently valid certificates during this transition. The organization expects the last 90-day certificate to expire on May 11, 2027, ensuring a complete shift to shorter lifespans.
What to do and how to stay safe: Let's Encrypt
- Test your ACME client in the Let’s Encrypt staging environment starting October 14, 2026, to verify 64-day handling.
- Audit cron jobs and scripts for hardcoded renewal intervals like 83 or 60 days, and adjust them to two-thirds of the new 64-day period.
- Ensure your ACME client supports ACME Renewal Info (ARI) so it can automatically detect renewal times without manual configuration.
- Configure alerts for failed certificate renewals to catch automation errors before they cause service outages.
Step-by-step guide: Mobile Device Security for Small Business: Control Without Cost
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When does Let’s Encrypt switch to 64-day certificates in production?
The switch occurs on February 10, 2027, according to the source material.
Will existing 90-day certificates be revoked early?
No, Let’s Encrypt will not revoke any valid certificates during the transition.
Do I need to change my setup if I use ARI?
No, sites using ACME Renewal Info should not need to change anything.
