Back to Devoured - October 12, 2026
DEVOURED
The First Reduction in Their History: 64-Day Let's Encrypt Certificates

The First Reduction in Their History: 64-Day Let's Encrypt Certificates

Tech securityweb Scott Helme
Let's Encrypt is reducing its default certificate lifetime from 90 days to 64 days starting February 10, 2027.
What: The move is a pre-emptive step toward stricter CA/Browser Forum requirements that will mandate even shorter certificate lifetimes in the future. Domain validation data reuse will also shrink from 30 days to 10 days on the same date.
Why it matters: Shortening certificate lifetimes is the industry's primary strategy to mitigate the impact of compromised keys, as traditional certificate revocation mechanisms remain largely ineffective.
Takeaway: If your infrastructure uses a fixed-schedule renewal process (e.g., renewing every 60 days), you must update it to be relative to the certificate lifetime, aiming to renew at 2/3 of the certificate's validity period (42 days for the new 64-day certificates). Use ACME clients that support ARI where available.
Deep dive
  • Staging for 64-day certificates begins October 14, 2026.
  • Production default switches to 64 days on February 10, 2027.
  • A further reduction to 45 days is scheduled for February 16, 2028.
  • The industry mandate (Ballot SC-081) will push maximum lifetimes to 47 days by March 2029.
  • ARI (ACME Renewal Information) allows the CA to signal when renewal is required, removing the need for hardcoded renewal schedules.
Decoder
  • ACME: Automated Certificate Management Environment, a protocol for automating the issuance and renewal of SSL/TLS certificates.
  • ARI (ACME Renewal Information): A protocol extension that allows a CA to tell a client when it should renew a certificate, preventing unnecessary renewals and simplifying the management of shorter lifetimes.
  • Revocation: The process of invalidating a certificate before its natural expiration date, which is notoriously difficult and unreliable in the current web ecosystem.
Original article

I remember being in the room at DEF CON 23 in Las Vegas, in 2015, listening to "Let's Encrypt – Minting Free Certificates to Encrypt the Entire Web". It was still months before Let's Encrypt would launch their public beta and begin cementing 90-day certificates as the new norm. More than a decade later, Let's Encrypt have just announced their first ever reduction to their default certificate lifetime, and it's coming soon.

The Dates

Here's what's happening and when:

Date Change
14 Oct 2026 Staging starts issuing 64-day certificates
10 Feb 2027 Production default drops from 90 days to 64 days
10 Feb 2027 Authorisation reuse drops from 30 days to 10 days
11 May 2027 The last 90-day certificate expires
16 Feb 2028 Default drops again to 45 days, authorisation reuse to 7 hours

Any certificate issued on or after 10 Feb 2027 gets a 64-day validity period, unless you've already opted in to something shorter than that. Those options have been around for a while now, with the 6-day certificates available via the shortlived profile and 45-day certificates via the tlsserver profile. What changes in February is the validity period for certificates using the default profile, so this will impact everybody, including those that may not have been paying attention.

Why Now?

Let's Encrypt have been ahead of the curve for their entire existence, launching with 90-day certificates when 3-year certificates were the norm, and this change is a continuation of that trend.

Last year, Ballot SC-081 passed at the CA/Browser Forum, setting a schedule that takes the maximum certificate lifetime from 398 days down to 200 days (March 2026), then 100 days (March 2027), and finally 47 days in March 2029. The maximum period that domain validation data can be reused shrinks alongside it, down to just 10 days by 2029.

Let's Encrypt's 90-day certificates were already comfortably inside the 2026 and 2027 changes, so they didn't have to do anything until 2029. Instead, they're stepping down gradually, with a 64-day stop on the way to 45 days, and giving everyone the ability to test this out gradually.

As for why shorter is better, I've been banging this drum for a long time... Revocation is broken, and has been for as long as I've been writing about it, so the only reliable way to limit the damage of a compromised key or a mis-issued certificate is to make sure the certificate doesn't live very long. I wrote Why we need to do more to reduce certificate lifetimes back in 2018, watched Ballot SC22 fail in 2019, saw Apple force the issue with the 1-year cap in 2020, and then asked Are shorter certificates finally coming?! in 2024. They are, and this is what it looks like when they arrive.

What Might Break

If your ACME client supports ARI (ACME Renewal Information), Let's Encrypt will tell it when to renew, and you don't need to think about the lifetime of your certificates at all.

ARI is relatively new though, and I'd bet, given how long Let's Encrypt have been around, that many automation processes are run on a fixed schedule. For 90-day certificates, renewing at 60 days old would be quite typical. This means that for those who have a fixed 60-day renewal process, this first reduction to 64-day certificates will just catch the new certificates before they expire, an intentional choice from Let's Encrypt I'm sure. If that is the case, organisations won't see any negative impact from this first reduction, but the 47-day certificates coming in March 2029 will cause problems and Let's Encrypt are reducing their certificates to 45-day certificates in February 2028 ahead of the deadline.

What To Do Now

The best thing is to check if your ACME client supports ARI and use that wherever possible. If not, you need to check how your certificates renew and if it's a fixed schedule. If you're renewing on a fixed schedule, it ideally needs to change to be relative to the validity period of the certificate, and you should aim to renew your certificates when they're 2/3 of the way through their validity period. For your existing 90-day certificates that's at 60 days, but for these new 64-day certificates, I'd be renewing them at 42 days.

After more than a decade at 90 days, the default is finally moving, and in a little less than 18 months from now, every Let's Encrypt certificate will be valid for half as long as it is today! It's pretty crazy to look back over how the ecosystem has changed during that time, and it's fair to say that Let's Encrypt has played, and continues to play, an enormous part in that.

Explore all 71 articles in today's digest

Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi