Let's Encrypt shortens its default certificate lifetime to 64 days from February 10, 2027
Let's Encrypt will issue certificates valid for 64 days by default from February 10, 2027, down from 90, Help Net Security reported. Staging opens October 14, 2026, 119 days earlier, and 45-day defaults follow in 2028.
The Watch · Security desk
Default lifetime falls to 64 days from February 10, 2027, down from 90. Renewing at two thirds of 64 days means about day 43. Renewing only at expiry means about 5.7 certificates a year, versus about 4.1 at 90 days. The default falls to 45 days in 2028.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Default lifetime from Feb 2027 | 64 days | down from 90 days | 1 |
| Renewal point, 64-day certificate | 43 days | about two thirds of 64 days | 15 |
| Expiry renewals a year at 64 days | 5.7 certificates | about; about 4.1 a year at 90 days | 18 |
| Default lifetime in 2028 | 45 days | 5 |
What happened
- Let's Encrypt expects the last 90-day certificate to expire on May 11, 2027, and says it will not revoke any valid certificates during the transition.
- Sites that renew through a client supporting ACME Renewal Info should not need to change anything, because ARI lets Let's Encrypt tell the client when to renew.
- Let's Encrypt's guidance is to renew once roughly two thirds of a certificate's validity has passed, and to look for day counts like 83, 80 or 60 hardcoded into cron jobs, runbooks and wrapper scripts.
- The authorization reuse period is also falling, from 30 days to 10 days, and to seven hours in 2028.
Why it matters
- What it costs cost A site that renews by hand at expiry issues about 4.1 certificates a year at 90 days, about 5.7 at 64 days and about 8.1 at 45 days. Each extra cycle is work for whoever owns the renewal.
- What it limits constraint A day count tuned to 64 days (about 43) has to change again at 45 days (30) under the same two-thirds rule. A fixed-schedule script gets edited twice in about two years.
- Who has to decide decision Moving to a client that supports ARI is the one change that takes the day count out of the site's own configuration, since Let's Encrypt then tells the client when to renew.
Next story · Security · Oct 7
Hijacked .gh, .sl and .as registries handed attackers HTTPS certificates for Google domainsConfirmed7 publishers
The staging window is 119 days, from October 14, 2026 to February 10, 2027 [14]. Let's Encrypt recommends testing there before the production switch [6]. The renewal trigger is what to test, because setups that renew at a fixed number of days need updating [7].
Sixty is two thirds of 90 days [16]. The same two-thirds rule applied to a 64-day certificate gives about 43 [15]. A job still timed for 60 days fires later than the point Let's Encrypt advises.
The move to shorter lifetimes "reduces the risk of key compromise and mis-issuance," said Sarah Gran of the Internet Security Research Group, the nonprofit that runs Let's Encrypt [4]. Gran recommends automating certificate reload and deployment and setting up alerts for failed renewals [13].
Subscribers who already use the optional 45-day or 6-day certificates are not affected [2]. Help Net Security's report does not address certificates renewed by hand.
The shorter authorization reuse period is a separate change. Gran said it complies with a 2029 reduction in maximum validation reuse periods and removes the need for CAA rechecking, where Let's Encrypt repeats part of validation if the data is more than seven hours old [11]. "Unless you have specifically designed your ACME client to rely on validation reuse, you will not need to make any changes," Gran said [10].
What to watch
- October 14, 2026: 64-day certificates appear in Let's Encrypt staging, and a client's renewal job either fires at the expected point or it does not.
- February 10, 2027: production default changes to 64 days, and the last 90-day certificate expires on May 11, 2027.
- 2028: the 45-day default and the seven-hour authorization reuse period, with dates Let's Encrypt has not yet specified in this report.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence88
- Adoption
- Not scored
- Hype gap0
- Incentives20
- Confidence86
Perspective Coverage
4 publishers- Builder
- Builder 29%
- Operator
- Operator 60%
- Investor
- Investor 11%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Starting February 10, 2027, Let's Encrypt will issue certificates valid for 64 days by default, down from 90 days.
- [2]
Subscribers who already use Let's Encrypt's optional 45-day or 6-day certificates are not affected by the change.
- [3]
Let's Encrypt expects the last 90-day certificate to expire on May 11, 2027, and will not revoke any valid certificates during the transition.
- [4]
The move to shorter certificate lifetimes "reduces the risk of key compromise and mis-issuance," said Sarah Gran of the Internet Security Research Group (ISRG), the nonprofit that runs Let's Encrypt.
- [5]
The 64-day period prepares users for default certificate lifetimes of 45 days in 2028.
- [6]
Let's Encrypt will start issuing 64-day certificates in its staging environment on October 14, 2026, and recommends testing there before the production switch.
- [7]
Setups that renew at a fixed number of days before expiration need updating.
- [8]
Let's Encrypt advises renewing at about two thirds of a certificate's lifetime and suggests searching cron jobs, wrapper scripts and runbooks for hardcoded values such as 83, 80 or 60.
- [9]
Let's Encrypt is cutting the authorization reuse period from 30 days to 10 days, and in 2028 the period will drop to seven hours.
- [10]
"Unless you have specifically designed your ACME client to rely on validation reuse, you will not need to make any changes," Gran said.
- [11]
Gran said the authorization reuse change complies with a 2029 reduction in maximum validation reuse periods and removes the need for CAA rechecking, where Let's Encrypt repeats part of the validation process if the validation data is more than 7 hours old.
- [12]
Sites that automate renewals through a client supporting ACME Renewal Info (ARI) should not need to change anything, since ARI lets Let's Encrypt tell the client when to renew.
- [13]
Sarah Gran recommends automating certificate reload and deployment, and setting up alerts for failed renewals.
- [14]
The staging window before the production switch is 119 days.
- [15]
Two thirds of a 64-day lifetime is about 43 days.
- [16]
Two thirds of a 90-day lifetime is 60 days.
- [17]
Two thirds of a 45-day lifetime is 30 days.
- [18]
A certificate renewed only at expiry is issued about 4.1 times a year at a 90-day lifetime, about 5.7 times at 64 days and about 8.1 times at 45 days.
Sources
4 independent publishers whose own reporting we read for this story.
- helpnetsecurity.comLet’s Encrypt TLS certificate lifetimes to drop from 90 to 64 days starting February 2027
1 article · October 12, 2026
- letsencrypt.org
letsencrypt.org
1 article · October 13, 2026
- lwn.netLet's Encrypt moving to 64-day certificate lifetimes in 2027
1 article · October 9, 2026
- securityweek.comLet’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch
1 article · October 12, 2026
Topics and entities
Topics
- TLS certificate lifetimes
- Web PKI
- Certificate automation
Entities
- Let's Encrypt
- Internet Security Research Group
- ACME Renewal Info
- CA/Browser Forum