Let’s Encrypt plans to start issuing 64-day certificates by default under its classic ACME profile on February 10, 2027, down from the 90-day lifetime it uses today. The change applies to certificates issued or renewed on or after that date. Let’s Encrypt says it will not revoke valid certificates because of the transition. The risk for most sites is not the new number itself but renewal automation tuned to the old one, such as a fixed renewal interval that works for 90-day certificates and fails for 64-day ones.
What changes on February 10, 2027
The default classic ACME profile moves from 90-day to 64-day certificates. The change is scheduled, not yet in effect, and it takes effect for new issuance and renewals only. A certificate issued on February 9, 2027 with a 90-day lifetime keeps that lifetime until it expires. Let’s Encrypt expects the last 90-day certificate to expire on May 11, 2027 (Let’s Encrypt, “64-Day Certificate Lifetimes Coming Feb 2027,” October 7, 2026).
As an Amazon Associate I earn from qualifying purchases.
Two other settings change on the same date. Authorization reuse drops to 10 days, meaning a completed domain validation can be reused for a shorter window before the client must prove control again. The change is specified in the same announcement.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteThe 64-day default applies to the classic profile only. Subscribers who explicitly select another profile, such as the tlsserver or shortlived profiles, are governed by that profile’s lifetime. Let’s Encrypt’s December 2, 2025 post on the move to 45 days states that the opt-in tlsserver profile moves to 45-day certificates on May 13, 2026 (Let’s Encrypt, “Decreasing Certificate Lifetimes to 45 Days,” December 2, 2025). The source does not restate the shortlived profile’s lifetime in the material covered here, so check that profile directly if you use it.
#1 Best Overall
Timeline
The schedule below is the published plan as of October 9, 2026. Dates after that are subject to change, so confirm them against Let’s Encrypt’s announcements before you finalize automation changes.
| Date | Change | Scope | Source |
|---|---|---|---|
| May 13, 2026 | Opt-in tlsserver profile moves to 45-day certificates | Only subscribers who select the tlsserver profile | December 2, 2025 post |
| October 14, 2026 | Staging switches to 64-day certificates | Let’s Encrypt staging environment only | October 7, 2026 announcement |
| February 10, 2027 | Default classic profile moves to 64-day certificates; authorization reuse drops to 10 days | Certificates issued or renewed on or after this date | October 7, 2026 announcement; December 2, 2025 post |
| May 11, 2027 | Expected expiry of the last 90-day certificate | Transition tail; certificates issued before February 10, 2027 | October 7, 2026 announcement |
| February 16, 2028 | Default classic profile moves to 45-day certificates; authorization reuse drops to seven hours | Certificates issued or renewed on or after this date | December 2, 2025 post |
Preparing renewal automation
The transition is mostly a test of whether renewals happen on time with a shorter window. Let’s Encrypt’s announcement lists the following preparation steps.
- Test renewal flows in staging. Once staging issues 64-day certificates on October 14, 2026, run your ACME client against it and confirm that a full issue, deploy, and reload cycle completes without manual intervention.
- Check ARI support in your client. ACME Renewal Information (ARI) lets the certificate authority tell a client when to renew. Let’s Encrypt says compatible automated clients should already be set up correctly. Read your client’s documentation to confirm it supports ARI and has it enabled.
- Search for hard-coded renewal intervals. Check cron jobs, wrapper scripts, configuration files, and runbooks for fixed renewal days. Let’s Encrypt specifically names values of 83, 80, and 60 days as common examples. These were set for 90-day certificates: a fixed 83-day interval leaves 7 days before expiry on a 90-day certificate, but on a 64-day certificate the renewal would fire 19 days after expiry.
- Move fixed renewals to about two-thirds of the lifetime. Sarah Gran, author of the October 7, 2026 announcement, writes: “If your renewals are hard-coded to a date from expiration you should update them to renew at approximately ⅔ of the lifetime instead.” For a 64-day certificate, that means renewing roughly 43 days after issuance, which leaves about 21 days of margin. The same adjustment prepares systems for the 45-day default planned for 2028.
- Alert on failed and missed renewals. A shorter lifetime leaves less time to notice a broken renewal before the certificate expires. Make sure monitoring catches both failed renewal attempts and renewals that never ran. Where certificate deployment or service reload is still manual, automate it.
What the change does not affect
Let’s Encrypt says the change will not affect rate limits, ACME endpoints, or issuance chains. Existing valid certificates are not revoked as part of the transition. The change takes effect at issuance and renewal, so a site with a valid certificate on February 10, 2027 keeps it until its normal expiry.
Why Let’s Encrypt is shortening lifetimes
Let’s Encrypt says shorter lifetimes reduce how long a mis-issued certificate or a certificate with a compromised private key can remain valid, and they encourage certificate management automation. Its certificate lifetime rationale page links the planned 45-day target to changes in the CA/Browser Forum Baseline Requirements (Let’s Encrypt, “Certificate Lifetime Rationale and Plans,” last updated July 22, 2026).
Rank #3
The figures in these announcements are schedule values, not measured outcomes. Neither the announcement nor the rationale page reports data on how much risk the shorter lifetimes remove, so the case for the change rests on the reasoning above rather than on quantified results.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If renewals break after February 2027
Most failures after the switch will look like one of the following.
Rank #4
- 2-part carbonless unit set
- Consecutive numbering
- Includes Gift Certificates Available sign
- 25 certificates with envelopes per package
- White/canary form sequence
- Certificate expires with no renewal attempt: a fixed interval, often 60 to 83 days, is still in place and fires after expiry.
- Renewal fires but the new certificate is not deployed: the client renews, but the web server or load balancer is not reloaded or does not pick up the new files.
- Renewal fails silently: no alert is configured for failed attempts, so the problem surfaces only at expiry.
- Client ignores ARI: the client renews on its own schedule and does not follow the renewal window Let’s Encrypt provides.
Test each of these in staging before February 10, 2027, and fix the first one you find before moving on to the next.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
