Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch

What it is

Let's Encrypt will issue 64-day certificates by default for all newly issued or renewed certificates from February 10, 2027. The last 90-day certificate is expected to expire on May 11, 2027. This is the first step toward the 45-day lifetimes it has planned for 2028.

Preconditions / Affected

• Anyone renewing on a fixed schedule, such as a cron job that renews N days before expiry.
• Anyone whose ACME client does not implement ACME Renewal Info (ARI).
• Anyone who relies on the 7-hour CAA recheck window or on long authorization reuse.

What to do

• Check your ACME client's documentation to see whether it implements ARI. If renewals are automated and ARI is supported, the CA says you are "all set".
• If renewal is hardcoded to a number of days before expiry, set it to roughly two-thirds of the certificate lifetime. For a 64-day certificate that is about day 43. This is arithmetic on the page's two-thirds guidance, not a figure the page gives.
• Test against Let's Encrypt's staging environment, which starts issuing 64-day certificates this week. The CA recommends all customers do this before production changes.
• Expect the authorization reuse period to fall to 10 days next year and to seven hours in 2028. Workflows that validate once and issue much later will need to re-validate.

Caveats

• Let's Encrypt says the change does not affect ACME endpoints, its issuance chains, or rate limits. Pinned chains and rate-limit planning therefore need no change for this step.
• The reuse reduction complies with a 2029 reduction in maximum validation reuse periods. It also removes "CAA rechecking", where validation data older than 7 hours has to be partly repeated.
• The 45-day switch is described as planned for 2028, not yet scheduled to a specific date.
• The page says all publicly trusted CAs will make similar changes. Certificates from other CAs will follow their own timelines, which the page does not give.