Let's Encrypt to reduce certificate validity to 64 days

Let's Encrypt is transitioning its certificate validity period from 90 days to 64 days, with the production switch scheduled for February 10, 2027. This change aims to shorten certificate lifespans, but it poses risks to existing automation scripts and renewal logic that rely on fixed-day thresholds.

Staging services began utilizing 64-day certificates on October 14, 2026, to allow for testing. The transition will be complete once the final 90-day certificates expire around May 11, 2027. Looking further ahead, Let's Encrypt plans to move to a 45-day default on February 16, 2028, which will also reduce domain authorization reuse from 10 days to seven hours.

To avoid service disruptions, operators are advised to move away from hardcoded renewal windows—such as checking for expiry 30 days in advance—and instead adopt dynamic methods. Recommended strategies include using ACME Renewal Information (ARI) or calculating renewal thresholds as a percentage of the certificate's total lifetime to ensure compatibility with future, shorter durations.