Let’s Encrypt Sets 64-Day Certificate Deadline for February 2027

Created by Ben Voss
Let’s Encrypt Sets 64-Day Certificate Deadline for February 2027

Let’s Encrypt will begin issuing 64-day TLS certificates by default on February 10, 2027, replacing its current 90-day certificates and giving website operators a deadline to verify their renewal systems. The change is intended to reduce the risk associated with compromised or mis-issued certificates, while exposing problems in fixed or manual renewal processes.

February 10, 2027 begins the certificate-lifetime change

The new validity period will apply to certificates issued or renewed through Let’s Encrypt’s default profile on or after February 10, 2027. Let’s Encrypt expects the last 90-day certificate to expire on May 11, 2027, and says it will not revoke valid certificates as part of this transition.

Let’s Encrypt will switch its staging environment to 64-day certificates on October 14, 2026, allowing developers and infrastructure teams to test before the production change. The organization plans to reduce the default lifetime again, to 45 days, on February 16, 2028.

Fixed 90-day assumptions create the main outage risk

Automated certificate management should adapt more easily when the ACME client supports ACME Renewal Information, or ARI. The standard allows a certificate authority to provide a recommended renewal window instead of requiring clients to rely on a fixed schedule.

Systems that renew certificates manually—or scripts that contain hard-coded assumptions about a 90-day certificate—need review. Let’s Encrypt recommends renewing at approximately two-thirds of the certificate’s lifetime, checking for common hard-coded values, and adding alerts for renewal failures.

Run a Certbot renewal test before production changes

  1. List certificates managed by Certbot with certbot certificates and identify certificates maintained by manual scripts or custom deployment tooling.
  2. Run certbot renew --dry-run to verify that the existing authentication method, web-server integration, and renewal configuration work correctly.
  3. Check the ACME client’s documentation for ARI support, remove hard-coded 90-day assumptions, and confirm that renewal-failure alerts reach the responsible operator.

Certbot’s renew command is designed for repeated automated use: it checks previously obtained certificates and renews only those that are ready. Scheduling regular checks is therefore safer than waiting for a single renewal date calculated from the original issuance.

Shorter certificates make automated renewal more important

The immediate change applies to Let’s Encrypt’s default certificate profile, while the broader certificate ecosystem is also moving toward shorter validity periods. Let’s Encrypt says the reductions are intended to limit the impact of key compromise and mis-issuance. For legacy systems, the change makes certificate renewal a production dependency that needs testing, monitoring, and a documented recovery process.

References

  1. Arghire, I. (2026, October 12). Let’s Encrypt cuts default certificate validity to 64 days ahead of 45-day switch. SecurityWeek. https://www.securityweek.com/lets-encrypt-cuts-default-certificate-validity-to-64-days-ahead-of-45-day-switch/
  2. Gran, S. (2026, October 7). 64-day certificate lifetimes coming Feb 2027. Let’s Encrypt. https://letsencrypt.org/2026/10/07/64-day-certs
  3. Electronic Frontier Foundation. (n.d.). User guide: Certbot 5.8.0 documentation. https://eff-certbot.readthedocs.io/en/stable/using.html
  4. Gable, A. (2025, September 16). ACME Renewal Information (ARI) published as RFC 9773. Let’s Encrypt. https://letsencrypt.org/2025/09/16/ari-rfc