Let's Encrypt Is Shortening Certificates to 64 Days: The Dates That Matter and What to Fix Before Them

Website certificates are about to expire faster. Let’s Encrypt, the free certificate authority behind a huge share of the web’s HTTPS padlocks, is moving its default certificate lifetime from 90 days to 64, and further cuts are already scheduled. Automated renewals that are set up correctly won’t notice. Hand-tuned scripts and manual processes will.

This timeline is based on Help Net Security’s report by Sinisa Markovic and on Let’s Encrypt’s own announcement.

The timeline

December 2025: the long-range plan

Let’s Encrypt first set out its path to 45-day certificates. In line with the CA/Browser Forum’s Baseline Requirements, all publicly trusted certificate authorities are expected to make similar moves.

October 7, 2026: the 64-day date is announced

The nonprofit set February 10, 2027 as the date its default lifetime drops to 64 days. Its reasoning: shorter lifetimes reduce the risk from stolen keys and wrongly issued certificates.

October 14, 2026: testing opens

The Let’s Encrypt staging environment begins issuing 64-day certificates, so administrators can test renewal setups before the production change.

February 10, 2027: 64 days becomes the default

Every certificate issued or renewed from this date on is valid for 64 days, unless the subscriber has already chosen one of the shorter 45-day or 6-day options. Those subscribers aren’t affected.

May 11, 2027: the last 90-day certificate expires

Let’s Encrypt expects the final 90-day certificate to run out around this date. It won’t revoke any valid certificates as part of the switch.

2028: 45 days, and seven-hour authorizations

Default lifetimes are planned to fall to 45 days. Separately, Let’s Encrypt is cutting how long a completed domain validation can be reused, from 30 days to 10, and then to seven hours in 2028. That keeps it in line with a 2029 industry limit on validation reuse. Unless your ACME client was built specifically to rely on reused validations, nothing changes on your side.

What stays the same

Rate limits
ACME endpoints
Certificate issuance chains

The fix list

Check for ARI support. If renewals are automated and your ACME client supports ACME Renewal Info (ARI), Let’s Encrypt tells the client when to renew and you should be fine. The client’s documentation will say whether ARI is implemented.
Remove fixed renewal windows. Scripts that renew a set number of days before expiry should renew at roughly two-thirds of the certificate’s life instead. Search cron jobs, wrapper scripts and runbooks for hardcoded values such as 83, 80 or 60.
Automate the last mile. Getting a new certificate isn’t enough; services must reload it and every device that uses it must receive it.
Alert on failures. Set up notifications when a renewal fails, so you find out before visitors see a browser warning.
Test in staging once the 64-day certificates are available there.

What this means for your company

An expired certificate doesn’t just look bad. It can break customer logins, payment pages, VPN portals and the connections between your systems. Shorter lifetimes mean any certificate still renewed by hand, or by a script nobody has checked in years, will fail more often. Start by listing every certificate the business depends on, including those on firewalls, remote access appliances, printers and internal tools, along with who renews each one and how. Then automate renewal and monitoring wherever you can, since the 45-day schedule after this will be even less forgiving.

Need help finding every certificate your business relies on and putting renewals on autopilot? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.