Key points
- Default certificate validity drops to 64 days starting February 10, 2027.
- A final shift to 45-day lifetimes is planned for 2028.
- Authorization reuse periods will shrink to 10 days in 2027 and seven hours in 2028.
Let’s Encrypt will reduce the default validity period of its digital certificates to 64 days beginning February 10, 2027. This change serves as an intermediate step toward a more aggressive 45-day validity period scheduled for 2028. The open Certificate Authority announced this timeline in a December 2025 blog post, aligning with industry-wide efforts to enhance web security through shorter certificate lifespans.
How it unfolded
- In December 2025, Let’s Encrypt revealed its plan to transition to 45-day certificates by 2028.
- Last week, the CA confirmed that 64-day validity becomes the default on February 10, 2027.
- This week, Let’s Encrypt began issuing 64-day certificates in its staging environment for testing.
Who is affected
All organizations relying on Let’s Encrypt for TLS/SSL certificates must adapt their renewal processes. According to SecurityWeek, the last 90-day certificate issued under the old default is expected to expire on May 11, 2027. After February 10, 2027, every newly issued or renewed certificate will carry a 64-day lifetime. This affects any system with hardcoded renewal schedules or manual renewal procedures that do not automatically adjust to shorter validity windows.
The change also impacts authorization reuse periods. Let’s Encrypt will reduce this period to 10 days in 2027 and further to seven hours in 2028. The CA states this adjustment complies with a 2029 reduction in maximum validation reuse periods. It also eliminates the need for "CAA rechecking," a process where validation repeats if data is older than seven hours. These operational shifts do not affect ACME endpoints, issuance chains, or rate limits.
What happens next
Customers are advised to test their environments immediately. Let’s Encrypt recommends using the staging environment, which is now issuing 64-day certificates, to verify that automation handles the shorter lifespan correctly. Systems that rely on ACME Renewal Info (ARI) should function without modification, as ARI allows the CA to instruct clients when to renew. Administrators should consult their ACME client documentation to confirm ARI support.
For systems with hardcoded renewal dates, Let’s Encrypt suggests setting the renewal trigger to approximately two-thirds of the certificate’s lifetime. This ensures renewals occur well before expiration, preventing service interruptions. The CA emphasizes that these changes are part of a broader industry trend mandated by the CA/Browser Forum Baseline Requirements. Shorter validity periods improve security by making revocation more efficient and limiting the scope of any potential compromise.
What to do and how to stay safe: Let’s Encrypt
- Verify that your ACME client supports ACME Renewal Info (ARI) to ensure automatic renewal timing adjusts to the new 64-day default.
- Test certificate issuance and renewal processes in the Let’s Encrypt staging environment before the February 10, 2027 production change.
- Update any hardcoded renewal schedules to trigger approximately two-thirds into the certificate’s validity period.
- Review internal documentation to ensure teams understand the upcoming 2028 shift to 45-day certificates and seven-hour authorization reuse.
Step-by-step guide: Mobile Device Security for Small Business: Control Without Cost
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When does the 64-day default validity period take effect?
The new default validity period of 64 days begins on February 10, 2027, for all newly issued or renewed certificates.
Does this change affect ACME endpoints or rate limits?
No, Let’s Encrypt states that the change will not affect ACME endpoints, issuance chains, or rate limits.
Why is Let’s Encrypt shortening certificate validity periods?
The changes comply with CA/Browser Forum Baseline Requirements to improve web security by making revocation more efficient and limiting compromise scope.
