Let's Encrypt Is Moving to 64-Day Certificates: A Small-Site Checklist
This entry is about Let's Encrypt, the free certificate authority run by the nonprofit Internet Security Research Group (ISRG), and a change that affects anyone who keeps a small site on HTTPS. It is a notebook page about a public announcement, not a report of something we changed. The facts below come from Let's Encrypt's own post and one independent write-up, both linked.
What was announced
- On October 7, 2026, Let's Encrypt published 64-Day Certificate Lifetimes Coming Feb 2027, written by Sarah Gran.
- On February 10, 2027, the default certificate lifetime drops from 90 days to 64 days. Any certificate issued or renewed on or after that date gets a 64 day validity period.
- Subscribers who already choose the shorter 45 day or 6 day options keep them.
- Let's Encrypt expects the last 90 day certificate to expire on May 11, 2027, and says it will not revoke valid certificates as part of the process.
- Its Upcoming Features page says the next step after 64 days is 45 days on February 16, 2028.
Help Net Security covered the news on October 12 and quotes the reason given: shorter lifetimes reduce "the risk of key compromise and mis-issuance."
What stays the same
- Rate limits are not affected by this change.
- ACME endpoints and issuance chains are not affected either.
- If your renewals are automated and your ACME client supports ACME Renewal Info (ARI), Let's Encrypt says you should be all set, because ARI lets the certificate authority tell your client when to renew. Your client's documentation will say whether ARI is implemented.
The one thing to check
The post singles out setups where renewal is hard-coded to a fixed number of days before expiry. Those should be changed to renew at roughly two thirds of the certificate's lifetime. Let's Encrypt's suggested way to find them: grep your cron jobs, wrapper scripts and runbooks for common hardcoded numbers such as 83, 80 or 60.
A bit of our own arithmetic, not from the post: two thirds of 64 days is about 43 days, so the renewal point moves from roughly day 60 of a 90 day certificate to roughly day 43 of a 64 day one. A hard-coded "renew when 60 days remain" rule is the kind of thing worth rereading, because 60 days before expiry is only 4 days after issuance on a 64 day certificate, and a value like 83 would be past the start of the certificate's life entirely. That is an illustration of why a proportional rule or ARI is safer, not a description of any real setup.
A second, quieter change
Let's Encrypt is also shortening the authorization reuse period, the window in which a completed domain check can be reused. It goes from 30 days to 10 days, and in 2028 to seven hours. The stated reason is compliance with a 2029 reduction in maximum validation reuse periods and removing the need for "CAA rechecking". Unless your ACME client was specifically designed to rely on validation reuse, you will not need to change anything.
Test before the switch
- Let's Encrypt began issuing 64 day certificates in its staging environment on October 14, 2026, and recommends testing renewals there before the production change. A community forum thread tracks the staging change.
- The post also suggests using this window to automate certificate reload and deployment, and to add alerting for renewal failures.
Why this belongs in a notebook
Small sites rarely fail because of a clever attack. They fail because a renewal job quietly stopped, or a number in a script assumed 90 days forever. With a 45 day default coming in 2028, the sensible habit is to stop trusting calendar math and let the client and the certificate authority negotiate timing. Three months is enough notice to read your own scripts once and fix anything that hard-codes a day count.
Sources: Let's Encrypt announcement, Let's Encrypt upcoming features, Help Net Security.