Let's Encrypt: default certificate lifetime drops to 64 days on 2027-02-10

Summary

On 2027-02-10 Let's Encrypt moves all subscribers to certificates with a 64-day lifetime by default. Certificates issued or renewed on or after that date are affected; valid certificates are not revoked. Renewal jobs with hard-coded timings may fail to renew in time.

What changes?

Certificates issued or renewed from 2027-02-10 are valid for 64 days instead of 90 (unless 45 or 6 days is selected). Renewals hard-coded to a fixed number of days before expiry (e.g. 83, 80 or 60) may run too late or at the wrong time, risking expired certificates. The authorization reuse period shrinks from 30 to 10 days (7 hours in 2028), which only matters for ACME clients designed to rely on validation reuse.

Affected

• All Let's Encrypt subscribers using the default lifetime
• ACME clients, cron jobs, wrapper scripts and runbooks with hard-coded renewal timings
• ACME clients relying on authorization reuse
• Not affected: ACME endpoints, issuance chains, rate limits

Preparation and temporary exceptions

1. Test in the Let's Encrypt staging environment, which issues 64-day certificates since 2026-10-14.
2. Check whether your ACME client supports ACME Renewal Info (ARI); if so, renewal timing is handled automatically.
3. Otherwise change hard-coded renewal timings to approximately 2/3 of the lifetime.
4. Search cron jobs, wrapper scripts and runbooks for hard-coded numbers such as 83, 80 or 60.
5. Add alerting for renewal failures and automate reload and deployment of certificates.

Check and complete

This is a planned change and will not be reverted. Verify readiness by testing in staging. The last 90-day certificate is expected to expire on 2027-05-11.

Recommendation

Inventory all systems using Let's Encrypt certificates, confirm ARI support or adjust renewal timings to about 2/3 of the lifetime, and test in staging before 2027-02-10. Set up monitoring for failed renewals and expiring certificates.

Timeline

1. 14 Oct 2026Staging environment switches to 64-day certificates for testing.
2. 10 Feb 2027All certificates issued or renewed from this date have a 64-day lifetime by default; authorization reuse period shrinks from 30 to 10 days.
3. 11 May 2027The last 90-day certificate is expected to expire.

Sources

• Let's Encrypt: 64-Day Certificate Lifetimes Coming Feb 2027 Vendor · letsencrypt.org

Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 15:55.