Let's Encrypt to shorten certificate lifetimes in 2027 update

Let's Encrypt is changing how long digital security certificates last for websites. Starting February 10, 2027, new certificates will be valid for 64 days instead of the current 90 days. This means owners must renew them more often to keep their sites secure.

Sites already using shorter durations like 45 days or 6 days will not face this update. Existing certificates that were issued before the change will remain valid until they naturally expire. Let's Encrypt expects the final 90-day certificate to run out on May 11, 2027.

The nonprofit group ISRG says this move reduces the risk of key compromise and mis-issuance. Sarah Gran explains that advancing security for everyone using the web is part of their mission. Longer lasting keys mean hackers have more time to misuse them if stolen.

This 64-day limit serves as an intermediate step before another shift in 2028. Administrators should prepare for a default lifetime dropping to 45 days next year. The organization plans to further shorten the validation reuse period during that time as well.

Testing will begin early so administrators can check their systems without risk. Let's Encrypt will introduce 64-day certificates in its staging environment on October 14, 2026. Users are recommended to test their renewal setups there before the production switch happens.

Most modern setups using ACME Renewal Info do not need any changes to work correctly. These clients automatically know when to renew based on new data from the certificate authority. However, admins should review client documentation to confirm their tools support this feature.

Older systems that rely on fixed renewal scripts require manual updates to match the new timeline. Let's Encrypt advises checking cron jobs or wrapper scripts for hardcoded values like 83, 80 or 60 days. Renewing at about two thirds of a certificate's lifetime is suggested during this transition.

Another upcoming change involves the period during which domain authorizations can be reused. This window will reduce from 30 days to 10 days starting with the new timeline. By 2028, that reuse period will shrink further to just seven hours.

These validation changes are designed to comply with a 2029 reduction in maximum reuse periods. They also aim to remove the need for CAA rechecking if validation data is older than seven hours. Unless a client was specifically designed to rely on validation reuse, most users will not need to make additional changes.