Let’s Encrypt Sets 64-Day Certificate Validity Default for February 2027

Let’s Encrypt announced that it will reduce the default validity period of its issued certificates to 64 days starting February 10, 2027. According to SecurityWeek, this adjustment marks the first step toward a further reduction to 45-day lifetimes scheduled for 2028. The open Certificate Authority stated this change aligns with CA/Browser Forum Baseline Requirements.

The move aims to improve web security by making certificate revocation more efficient and limiting the scope of potential compromises. Let’s Encrypt noted in a December 2025 blog post that all publicly trusted Certificate Authorities will implement similar changes. The organization revealed the planned timeline for switching to 45-day certificates during that announcement, setting expectations for the broader industry shift.

Context and Background

After February 10, 2027, all newly issued or renewed certificates from Let’s Encrypt will carry a 64-day validity period. The last 90-day certificate is expected to expire on May 11, 2027, marking the end of the previous standard. Let’s Encrypt will begin issuing these shorter-lived certificates in its staging environment this week for testing purposes. The CA recommends that all customers perform similar tests before the change enters production to ensure their systems can handle the increased renewal frequency.

In addition to validity periods, Let’s Encrypt will reduce the authorization reuse period to 10 days next year. This period will further decrease to seven hours in 2028. The organization explained that these changes comply with a 2029 reduction in maximum validation reuse periods. The adjustments also remove the need for CAA rechecking, which currently requires repeating part of the validation process if data is older than seven hours.

Who Is Affected

Users with automated renewals and ACME clients that support ACME Renewal Info (ARI) should be prepared for the transition. ARI allows Let’s Encrypt to inform clients when to renew certificates, simplifying the process. Customers should review their ACME client documentation to determine if ARI is implemented. For certificates with renewals hardcoded to a specific date from expiration, Let’s Encrypt recommends setting the renewal date to approximately two-thirds of the certificate lifetime.

The changes will not affect ACME endpoints, issuance chains, or rate limits, according to Let’s Encrypt. This stability ensures that existing infrastructure components remain functional while the validity parameters shift. Organizations relying on manual renewal processes or older automation scripts may need to update their configurations to accommodate the shorter lifecycle. Testing in staging environments is critical to identify any compatibility issues before the production switch.

What should you do?

Security teams should verify that their ACME clients support ACME Renewal Info to automate renewals effectively. Those without ARI support should adjust hardcoded renewal schedules to trigger approximately two-thirds through the certificate’s lifetime. Administrators must test renewal processes in Let’s Encrypt’s staging environment to confirm functionality. Monitoring certificate expiration dates closely will help prevent service disruptions during the transition period.

What to do and how to stay safe: Let’s Encrypt

• Verify ACME client support for ACME Renewal Info to enable automated renewal notifications.
• Adjust hardcoded renewal schedules to trigger approximately two-thirds through the new 64-day validity period.
• Test certificate issuance and renewal processes in Let’s Encrypt’s staging environment before the February 2027 change.
• Monitor certificate expiration dates closely to ensure timely renewals and prevent service interruptions.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When does Let’s Encrypt switch to 64-day certificate validity?

The switch occurs on February 10, 2027, when all newly issued or renewed certificates will have a 64-day validity period.

Why is Let’s Encrypt reducing certificate validity periods?

The reduction aligns with CA/Browser Forum Baseline Requirements to improve security by making revocation more efficient and limiting compromise scope.

Will this change affect ACME endpoints or rate limits?

No, Let’s Encrypt stated that the change will not affect ACME endpoints, issuance chains, or rate limits.