Let's Encrypt to reduce TLS certificate validity to 64 days

Let's Encrypt has announced it will reduce the default validity period of its TLS certificates from 90 days to 64 days, effective February 10, 2027. All certificates issued or renewed on or after this date will carry the new 64-day lifespan, though users may explicitly opt for shorter durations of 45 or six days.

Existing certificates will remain valid until their original expiration dates, and the organization confirmed that no valid certificates will be revoked during this transition. The final 90-day certificate is expected to expire by May 11, 2027.

This change is an intermediate step in a long-term strategy to enhance web security by limiting the window of usability for compromised or incorrectly issued certificates. Let's Encrypt plans to further reduce the default lifetime to 45 days in 2028. Additionally, the period for reusing domain authorization will be reduced from 30 days to 10 days, eventually shrinking to seven hours in 2028.

To assist system administrators, 64-day certificates will be available in a staging environment starting October 14, 2026, to allow for testing of renewal scripts and automated configurations.