Let's Encrypt to Reduce SSL/TLS Certificate Lifetimes to 64 Days in February 2027
The free certificate authority is shortening validity periods significantly, effective February 2027, impacting automated issuance systems.
Key points
- Let's Encrypt is cutting certificate lifetimes to 64 days.
- The change takes effect in February 2027.
- The adjustment impacts the issuance of free SSL/TLS certificates.
Let's Encrypt has announced it will reduce the validity period of its free SSL/TLS certificates to 64 days, with the change scheduled to take effect in February 2027. According to a report by Ars Technica, this reduction represents a significant shift in the operational norms for the widely used certificate authority.
The move shortens the standard lifespan of digital certificates issued by the organization. While previous lifetimes were longer, this new policy mandates that certificates expire after just over two months. This adjustment requires the infrastructure relying on Let's Encrypt to handle more frequent renewal cycles. The change is not immediate; administrators have a window of time before February 2027 to prepare their systems for the shorter duration.
Context and Background
Let's Encrypt has long provided free, automated, and open certificates to help secure websites. The service is designed to work with automation tools that handle the issuance and renewal process without manual intervention. By reducing the lifetime to 64 days, the authority is placing a greater emphasis on the reliability and speed of these automated renewal processes.
Shorter certificate lifetimes are generally considered a best practice in cybersecurity because they limit the window of exposure if a private key is compromised. However, they also demand that the underlying automation remains robust and uninterrupted. A failure in the renewal process could lead to service outages if the certificate expires before a new one is issued and deployed. The February 2027 deadline allows time for software updates and configuration changes across the ecosystem.
Who Is Affected
Any organization or individual using Let's Encrypt for website encryption will be affected by this change. This includes a vast number of websites, as Let's Encrypt is one of the largest certificate authorities in the world. System administrators, DevOps engineers, and web developers must ensure their renewal scripts and tools are configured to handle the increased frequency of certificate rotations.
Entities that rely on manual renewal processes or have delayed automation schedules are at higher risk of disruption. The transition to a 64-day cycle means that any delay in renewal could result in an expired certificate and subsequent browser warnings for users. Organizations must review their monitoring and alerting systems to ensure they are notified well before the expiration date.
What should you do?
Administrators should audit their certificate management systems to ensure they can handle more frequent renewals. It is important to verify that automation tools are functioning correctly and that there are no blockers in the renewal process. Monitoring logs for failed renewal attempts is critical to prevent unexpected expirations.
Background: Certificate management
Effective certificate management requires automated lifecycle tracking, strict validation of trust chains, and immediate revocation processes. Manual oversight fails at scale, leading to service outages or trust bypasses. Use standardized protocols and centralized inventory tools to maintain security posture without constant manual intervention.
Read the full guide: Certificate Management FAQs: Fixing Expiry, Rotation, and Trust
What to do and how to stay safe: Let's Encrypt
- Review automation scripts to ensure they can handle a 64-day renewal cycle without failure.
- Update monitoring alerts to trigger earlier, ensuring notification well before the new expiration date.
- Test the renewal process in a staging environment to identify potential issues before February 2027.
- Verify that all dependent systems can deploy new certificates automatically without manual intervention.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When does the new certificate lifetime take effect?
The new 64-day certificate lifetime takes effect in February 2027.
What is the new certificate lifetime for Let's Encrypt?
Let's Encrypt is reducing the certificate lifetime to 64 days.
Does this affect all Let's Encrypt certificates?
Yes, the change applies to the free SSL/TLS certificates issued by Let's Encrypt.
