Let’s Encrypt moves default certificates to 64-day validity in 2027
Let’s Encrypt plans to make its default TLS certificates valid for 64 days instead of 90 beginning February 10, 2027. The nonprofit says shorter validity periods reduce the chance that a key is compromised or a certificate is issued incorrectly and will prepare for a 45-day default in 2028; existing 45-day and 6-day certificate users are unaffected. Administrators should test the change in staging, rely on automated renewal where possible, and update scripts that renew after a fixed number of days, as the authorization reuse window will also shrink from 30 days to 10.
Let’s Encrypt will begin defaulting to 64-day TLS certificates on February 10, 2027, replacing 90-day validity. Its optional 45-day and 6-day certificates remain unchanged. The final 90-day certificate should expire May 11, 2027, and the CA says it will not revoke valid certificates during the switch. Testing starts in staging on October 14, 2026.
The shorter lifetime is intended to lower risks from compromised keys and incorrect issuance, and to prepare for a 45-day default in 2028. Authorization reuse will fall from 30 days to 10, then seven hours in 2028. Clients using ACME Renewal Info may need no changes; fixed renewal schedules should be reviewed.
Shorter certificate lifetimes could push more website operators toward automated renewal and monitoring, potentially reducing exposure from stolen keys or mistaken issuance. Administrators with manual or custom processes may face added workload and a higher risk of missed renewals, which could cause browser warnings or service interruptions. Everyday users may benefit from stronger baseline security, though they might also encounter more temporary site errors if organizations fail to adapt. The change may especially affect small teams with limited operations resources.