Let’s Encrypt continues to push for tighter security by reducing the lifespan of free SSL/TLS certificates from 90 days to 64 days, starting February 10, 2027. For administrators already deploying modern ACME clients that support ARI (ACME Renewal Information), the change should be seamless. For those still relying on hard-coded renewal programs or manual processes, February will be the deadline to upgrade before certificates begin to expire unexpectedly.
Starting October 14, Let’s Encrypt will begin testing 64-day certificates and interested users can choose to test their configurations before production begins.
Before the launch of Let’s Encrypt in early 2016, certificates were typically issued for between one and three years. The service started with 90-day certificates to force renewal automation that didn’t exist before. Shorter certificate validity periods limited vulnerabilities from private key theft and encouraged accelerated adoption of HTTPS on the web.
This move shook industry norms at the time, but by limiting certificate lifespans, certificates are less likely to cause harm if they are compromised or assigned in error. The reduction to 64 days continues this logic, and the useful life will continue to shorten as time goes on, with defaults of 45 days expected in 2028.
Just as the initial release of Let’s Encrypt was aimed at pushing users towards HTTPS, the shortened certificate windows are aimed at pushing users towards full ACME automation. The ACME protocol, and more specifically ARI (ACME Renewal Information), allows the certification authority to inform the client when it is time to renew. Although ARI does this, many implementations are still stuck on scheduled refresh intervals that trigger at fixed offsets like “60 days before expiration.”
