Let's Encrypt Cuts Default Certificates to 64 Days on February 10, 2027

Let's Encrypt will issue 64-day certificates by default from February 10, 2027, down from 90 days, and will cut the period it reuses a domain validation from 30 days to 10. The nonprofit certificate authority announced the change in an October 7 post by Sarah Gran.

The post says "all Let's Encrypt subscribers will move to certificates with 64 day lifetimes by default." Staging, the test environment, starts issuing 64-day certificates on October 14, 2026.

What breaks on February 10, 2027

The change applies to certificates issued or renewed on or after the date, so a server picks it up at its next renewal. Let's Encrypt said it will not revoke valid certificates. The last 90-day certificate is expected to expire on May 11, 2027.

Clients that speak ARI, the renewal-information protocol in which Let's Encrypt tells the client when to renew, should need no change. The risk sits in scripts with a number typed into them. Let's Encrypt suggests searching cron jobs, scripts and runbooks for values such as 83, 80 or 60, and renewing at about two-thirds of the certificate's lifetime instead.

The arithmetic is unkind to the common case. A job that renews at day 60 of a 90-day certificate leaves 30 days to notice a failure. On a 64-day certificate the same job leaves 4.

1. 90-day certificate (today)30 days
2. 64-day certificate (from Feb. 10, 2027)4 days

Source: Let's Encrypt post of 2026-10-07 (lifetimes); remaining days are subtraction, accessed 2026-10-09

A failed renewal is also what turns a certificate into an incident. Our report on the Citrix NetScaler exploitation shows the other side: Citrix tells owners of compromised appliances to replace SSL certificates after a restore, a chore that comes round more often as lifetimes shrink.

The 10-day validation window

The second change is quieter. Let's Encrypt is shortening authorization reuse, the window in which it will skip a fresh domain check for a name it already validated, from 30 days to 10 now. The post says it falls to seven hours in 2028.

Only clients that lean on reuse need to change. If your ACME client re-runs validation at every order, nothing moves. If it assumes a validation from three weeks ago still counts, it will start failing on the February date.

Rate limits are unaffected, according to the post, which points back to a February 24, 2026 post. That post puts the New Orders per Account limit at 300 per three hours and exempts renewals from rate limits.

Why 64 days and not 100

The industry's own ceiling is higher. The CA/Browser Forum, the body that sets the rules for certificate authorities and browsers, voted in April 2025 to cap lifetimes at 200 days from March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029, Computerworld reported. Let's Encrypt is going below each cap ahead of time.

Date	Let's Encrypt default	CA/B Forum maximum
Today	90 days	200 days
Feb. 10, 2027	64 days	200 days
Mar. 15, 2027	64 days	100 days
2028	45 days	100 days
Mar. 15, 2029	45 days	47 days

The Computerworld piece reported that Apple pushed the changes and that the vote passed with no "No" votes and five abstentions. Tim Callan, chief compliance officer at Sectigo and vice chair of the CA/Browser Forum, said he personally applauds them. Jon Nelson, a principal advisory director at Info-Tech Research Group, questioned whether the group's motives are purely about reducing risk.

Let's Encrypt's own rationale is narrower: shorter lifetimes reduce the exposure from a compromised key or a mis-issued certificate. Browser vendors are moving on the same clock, as the two-week Chrome release cycle shows for a different kind of deadline.

What is still unknown

The post does not name the exact day in 2028 when the default reaches 45 days. The CA/Browser Forum schedule here comes from Computerworld's account, not from the Forum's own ballot text, which this report did not read. For anyone running a hand-rolled renewal script, the dated step is October 14: that is when a 64-day certificate can first be requested from staging to see what the script does.