Let's Encrypt to reduce certificate lifetimes to 64 days in 2027

Let's Encrypt, the world's largest certificate authority, has announced it will reduce the lifetime of its free SSL/TLS certificates from 90 days to 64 days, effective February 10, 2027.

This reduction aims to enhance security by limiting the potential impact of private key thefts or incorrect certificate assignments. The move also serves to push web administrators toward full ACME automation, specifically utilizing ACME Renewal Information (ARI). Administrators relying on manual processes or hardcoded renewal schedules must update their systems to avoid unexpected expirations.

Testing for the 64-day certificates will begin on October 14, 2026, allowing users to opt in and verify their renewal workflows. This is part of a long-term strategy to shorten certificate lifespans; Let's Encrypt previously announced plans to further reduce the default validity to 45 days in 2028. Additionally, the authorization reuse period will be reduced from 30 days to 10 days, with a planned reduction to 7 hours by 2028.