Let’s Encrypt has announced that its default certificate lifetime will drop from 90 days to 64 days, for certificates issued or renewed on or after February 10, 2027. It is the next step in an industry-wide move to shorter certificates, with a 45-day default planned from February 16, 2028.

The details

• Existing 90-day certificates keep working until they expire; nothing is revoked. The last 90-day certificates should expire around May 11, 2027
• 64-day certificates went live in the staging environment on October 14, 2026, so you can test now
• Authorization reuse drops from 30 days to 10 days: proof of domain control from a recent validation can be reused for less time

Will your renewals break?

If you use certbot, a modern ACME client, or a web server with built-in ACME such as Caddy, probably not. Clients that support ACME Renewal Information (ARI) ask Let’s Encrypt when to renew and adapt automatically.

The risk is fixed-interval renewal jobs. Let’s Encrypt recommends renewing at about two-thirds of a certificate’s lifetime and checking scripts and cron jobs for hard-coded values such as 83, 80, or 60 days, which were common with 90-day certificates. A job that renews every 60 days would leave a 64-day certificate expiring with almost no margin.

What to do now

1. Find how each server renews: systemctl list-timers | grep -i cert, crontab -l, and your web server’s ACME settings
2. Remove hard-coded day counts in favour of the client’s own logic, such as certbot renew, which renews certificates close to expiry
3. Test against staging with a 64-day certificate
4. Make sure renewal failures alert someone

Our Let’s Encrypt guide covers certbot setup, and our systemd timers guide covers scheduling renewals.