Let's Encrypt moves its default certificate lifetime to 64 days

Let's Encrypt moves its default certificate lifetime to 64 days

7 October 2026: Let's Encrypt will shorten the validity of the certificates it issues by default from 90 days to 64 days, with the production switch on 10 February 2027. Any certificate issued or renewed from that day carries the shorter lifetime. Sites that renew on a hard-coded schedule, such as a cron job that fires 60 days after issue, are the ones most likely to cause trouble.

The dates to put in the diary

Let's Encrypt's post, written by Sarah Gran, sets out the timetable:

• 14 October 2026: 64-day certificates begin issuing in the staging environment, so subscribers can test.
• 10 February 2027: 64-day lifetime becomes the default in production.
• 11 May 2027: the last 90-day certificate is expected to expire.
• 2028: the default is expected to fall again, to 45 days.

The organisation says it will not revoke valid certificates as part of the change, so existing 90-day certificates simply run out their term. Subscribers who already ask for the optional 45-day or 6-day lifetimes announced in December 2025 are not affected by the new default.

Which renewal setups need changing

Clients that support ACME Renewal Info (ARI) should need no change, because the certificate authority tells the client when to renew. Whether a given client supports ARI is something to confirm in that client's documentation.

The risk lies with setups that renew a fixed number of days before expiry. Let's Encrypt advises renewing at roughly two-thirds of a certificate's lifetime, which is about 43 days into a 64-day certificate, and suggests searching cron jobs, wrapper scripts and runbooks for hard-coded values such as 83, 80 or 60. A script that waits 83 days is already too late for a 64-day certificate. Moving to a fraction of the lifetime rather than a number of days also covers the 45-day default expected in 2028.

The post also recommends testing against staging before February, automating the reload and deployment of renewed certificates, and alerting on failed renewals. With a shorter lifetime, a silent renewal failure leaves less time before an outage.

Shorter reuse of domain validation

A second change takes effect now: the period for which a successful domain validation can be reused drops from 30 days to 10 days, and is expected to reach seven hours in 2028. Let's Encrypt says this keeps it in line with a reduction in the maximum validation reuse period due in 2029 and removes the need for CAA rechecking, which repeats part of validation when the data is more than seven hours old. Unless an ACME client was designed to rely on validation reuse, no change is needed.

Rate limits, ACME endpoints and issuance chains are unaffected, according to the post. Let's Encrypt describes shorter lifetimes as a way to reduce the exposure from key compromise and mis-issuance.

Sources

• Let's Encrypt: 64-Day Certificate Lifetimes, 7 October 2026
• Help Net Security: Let's Encrypt TLS certificate lifetimes to drop from 90 to 64 days starting February 2027, 12 October 2026