Let's Encrypt moves to 64-day certificates on 10 February 2027, staging on 14 October

Victoria Shinder11 October 2026, 09:392 min read

Let's Encrypt announced on 7 October that its default certificate lifetime falls from 90 to 64 days on 10 February 2027. From that date every certificate it issues or renews carries the shorter validity, unless the subscriber has already opted into one of the even shorter profiles (45 or 6 days). The organisation expects the last 90-day certificate to expire on 11 May 2027 and says nothing already issued will be revoked to get there.

This is the middle step of a plan published in December 2025. The CA/Browser Forum Baseline Requirements are walking maximum lifetimes down, and Let's Encrypt intends to reach 45 days in 2028. The 64-day stage is the one that will find the cron jobs nobody has looked at since they were written.

The date to put in a calendar is 14 October 2026. That is when the staging environment starts issuing 64-day certificates, four months ahead of production. Anything that renews against staging will show the new behaviour first, and the announcement recommends testing there.

Who has to change something. The post splits subscribers into two groups:

• Clients that implement ACME Renewal Info (ARI) let the CA tell them when to renew, so they should need nothing. Whether your client implements ARI is a question for its own documentation.
• Setups that renew a fixed number of days before expiry are the ones that break. The advice is to renew at roughly two thirds of the lifetime instead, and Let's Encrypt suggests a blunt audit: search cron entries, wrapper scripts and runbooks for the usual hard-coded numbers — 83, 80 or 60 days. A renewal set for day 80 of a 64-day certificate never happens.

A second change rides along. The period for which a completed domain validation can be reused shrinks from 30 days to 10, and in 2028 to seven hours. Let's Encrypt ties this to a 2029 reduction in permitted validation reuse and to dropping its CAA re-check step. Only clients deliberately built around reusing old authorizations should notice.

What does not change, per the post: rate limits, the ACME endpoints and the issuance chains.

For operators the practical reading is short. Find every place a renewal is scheduled by a number rather than by ARI, test against staging after 14 October, and add an alert for a failed renewal — with 64-day certificates a renewal that silently stops working has less time to be noticed before browsers start refusing the site.

Source: Let's Encrypt, 64-Day Certificate Lifetimes Coming Feb 2027, 7 October 2026 — https://letsencrypt.org/2026/10/07/64-day-certs.html ; earlier plan — https://letsencrypt.org/2025/12/02/from-90-to-45