Let's Encrypt moves to 64-day certificates: audit your renewal automation now

Let's Encrypt has announced that its default certificate lifetime will drop from 90 to 64 days for anything issued or renewed on or after 10 February 2027, with a 45-day default planned for 2028. A staging environment starts issuing the shorter certificates from 14 October 2026, so teams can test before production changes. Existing valid certificates are not revoked, and the last 90-day certificate should expire around 11 May 2027. Clients that support ACME Renewal Info (ARI) will be told by the CA when to renew and likely need no changes. Anything hardcoded to renew a fixed number of days before expiry should move to roughly two-thirds of the lifetime; the advice is to search cron jobs, wrapper scripts and runbooks for values like 83, 80 or 60. Domain-validation reuse also shrinks, from 30 days to 10 now and to seven hours in 2028, which matters only if a client deliberately leans on cached validation. Rate limits, endpoints and issuance chains are unchanged. The practical takeaway: audit renewal automation, confirm reload and deploy hooks fire on every renewal, and alert on failures before shorter lifetimes shrink the margin for error.

This is a summary by our content curator. Read the original at Let's Encrypt: https://letsencrypt.org/2026/10/07/64-day-certs.