Let’s Encrypt to shorten TLS certificate lifetimes to 64 days in 2027

Let’s Encrypt will reduce the default lifetime of its TLS certificates from 90 days to 64 days beginning February 10, 2027, according to Help Net Security. This change requires website administrators to renew their security credentials more frequently to maintain encrypted connections for users.

The Internet Security Research Group (ISRG), the nonprofit that operates Let’s Encrypt, stated that shorter validity periods reduce the risk of key compromise and mis-issuance. Sarah Gran of ISRG described the shift as part of the organization’s mission to advance global web security. The move also prepares users for a further reduction to 45-day default lifetimes in 2028.

Transition timeline and testing

Let’s Encrypt plans to start issuing 64-day certificates in its staging environment on October 14, 2026. The organization recommends that administrators test their renewal processes in this environment before the production switch occurs. During the transition, Let’s Encrypt will not revoke any valid certificates. The last 90-day certificate is expected to expire on May 11, 2027.

Impact on renewal automation

Websites that automate renewals using clients supporting ACME Renewal Info (ARI) should not need to make changes. ARI allows Let’s Encrypt to inform the client directly when a renewal is required. Administrators should check their client documentation to confirm ARI support. However, setups that renew at a fixed number of days before expiration require updates to their configuration.

Let’s Encrypt advises renewing at approximately two-thirds of a certificate’s lifetime. The organization suggests searching cron jobs, wrapper scripts, and runbooks for hardcoded values such as 83, 80, or 60 days. Gran recommends automating certificate reload and deployment while setting up alerts for failed renewals to ensure continuous protection.

Authorization reuse changes

In addition to certificate lifetimes, Let’s Encrypt is cutting the authorization reuse period from 30 days to 10 days. This change aligns with a planned 2029 reduction in maximum validation reuse periods. In 2028, the reuse period will drop further to seven hours. Gran noted that this removes the need for CAA rechecking, which repeats part of the validation process if data is older than seven hours.

Unless an ACME client was specifically designed to rely on validation reuse, administrators will not need to make changes for this aspect of the update. Gran concluded that most users will experience minimal disruption from the authorization reuse adjustment. Subscribers already using optional 45-day or 6-day certificates are not affected by the new default lifetime policy.

What should you do?

Administrators should verify whether their ACME client supports ACME Renewal Info (ARI) to ensure automatic handling of shorter lifetimes. Those using fixed-interval renewal scripts must update hardcoded values to reflect the new 64-day validity period. Testing renewal processes in the Let’s Encrypt staging environment before October 2026 is recommended.

What to do and how to stay safe: Let's Encrypt

• Check if your ACME client supports ACME Renewal Info (ARI) for automatic renewal timing.
• Review cron jobs and scripts for hardcoded renewal intervals like 83 or 60 days.
• Test your renewal configuration in the Let’s Encrypt staging environment by October 2026.
• Set up alerts for failed certificate renewals to detect issues early.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When do Let’s Encrypt certificates change to 64 days?

The default validity period changes to 64 days starting February 10, 2027.

Will existing 90-day certificates be revoked?

No, Let’s Encrypt will not revoke valid certificates during the transition.

Do I need to change my setup if I use ARI?

No, clients supporting ACME Renewal Info should not need any changes.