Let's Encrypt: certificate validity drops from 90 to 64 days on 2027-02-10, 45 days by 2028

Summary

Let's Encrypt is shortening the validity of its certificates in stages, as required by the CA/Browser Forum Baseline Requirements. On 2027-02-10 the default classic profile moves to 64-day certificates. Users see the shorter validity at their next renewal after each date. Staging changes are deployed about one month earlier.

What changes?

From 2027-02-10, new certificates from the default classic profile are valid for 64 days instead of 90, and domain validation is reused for only 10 days instead of 30. From 2028-02-16 they are valid for 45 days with a 7-hour reuse period. Renewal setups with a fixed interval (for example every 60 days) or without monitoring can let certificates expire.

Affected

• Users of the default classic ACME profile (from 2027-02-10 and 2028-02-16)
• Users of the opt-in tlsserver profile (45 days since 2026-05-13)
• Not affected by the 2027 change: users who opted into the tlsserver or shortlived (6-day) profile
• ACME clients with hardcoded renewal intervals or manual renewals

Preparation and temporary exceptions

1. Check that your ACME client and automation work with shorter certificate validity.
2. Enable ACME Renewal Information (ARI) in your ACME client; see its documentation.
3. If the client does not support ARI, renew at about two thirds of the certificate lifetime; a fixed 60-day interval is no longer sufficient.
4. Set up monitoring that alerts when certificates are not renewed as expected.
5. Avoid manual renewals, as they are needed more often.

Check and complete

Not a defect. The change takes effect on the stated dates; verify your renewal automation beforehand. Let's Encrypt expects the new DNS-PERSIST-01 validation method to be available in 2026.

Recommendation

Inventory all systems that use Let's Encrypt certificates, enable ARI or adjust renewal intervals before 2027-02-10, replace manual renewals with automation, and add expiry monitoring. Optionally test with the tlsserver profile beforehand.

Timeline

1. 13 May 2026The opt-in tlsserver ACME profile switches to 45-day certificates.
2. 10 Feb 2027The default classic ACME profile switches to 64-day certificates with a 10-day authorization reuse period.
3. 16 Feb 2028The classic profile switches to 45-day certificates with a 7-hour authorization reuse period.

Sources

• Decreasing Certificate Lifetimes to 45 Days Vendor · letsencrypt.org

Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 15:57.