Let’s Encrypt is reducing free SSL/TLS certificate lifetimes from 90 days to 64 days, starting February 10, 2027. Administrators using modern ACME clients with ARI (ACME Renewal Information) should see a seamless transition; hardcoded renewal schedules or manual processes need updates before certificates expire unexpectedly.
Starting October 14, Let’s Encrypt begins testing 64-day certificates; users can opt in before production rollout.
Let’s Encrypt launched in 2016 with 90-day certificates to force renewal automation and limit damage from compromised keys. Shorter validity continues that model; 45-day defaults are planned for 2028.
Many deployments still renew on fixed offsets (e.g. 60 days before expiration). Let’s Encrypt recommends auditing cron jobs for hardcoded values like 83, 80, and 60, verifying ACME clients support ARI, and setting expiration notifications.
Authorization reuse periods will shrink from 30 days to 10 days, eventually to seven hours by 2028, reducing CAA recheck needs.
CA/Browser Forum industry mandates are driving broader certificate lifetime reductions industry-wide (e.g. maximum TLS certificate lifetime stepping down toward 47 days by March 2029).
Administrators have about four months after the October 14 test window to validate automation before the February 10, 2027 deadline.