Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch

Let’s Encrypt announced that beginning February 10, 2027, all newly issued or renewed certificates will have a default validity period of 64 days, down from the current 90 days. This is an intermediate step ahead of a planned switch to 45-day certificates in 2028, in compliance with CA/Browser Forum Baseline Requirements. Shorter certificate lifetimes are intended to enhance security by reducing the window of exposure if a certificate is compromised and by improving the efficiency of revocation processes. Additionally, Let’s Encrypt will reduce the authorization reuse period to 10 days in 2027 and further to seven hours in 2028 to comply with validation reuse limits and eliminate the need for repeated CAA rechecking. The change does not affect ACME endpoints, issuance chains, or rate limits. Let’s Encrypt advises customers to test these changes in staging environments and adjust renewal schedules, especially if renewals are hardcoded to specific dates.

The reduction in certificate validity periods will limit the time a compromised certificate can be exploited, thereby improving overall web security. It will also make revocation processes more effective by reducing the window during which revoked certificates might still be trusted. However, clients and automated renewal systems must be compatible with the shorter lifetimes to avoid service disruptions. The change does not introduce new vulnerabilities but requires operational adjustments for certificate management.

Let’s Encrypt recommends that customers test their ACME clients in the staging environment where 64-day certificates are already being issued. For clients supporting ACME Renewal Info (ARI), no action is needed as ARI handles renewal timing automatically. For clients with renewals hardcoded to specific expiration dates, it is advised to set renewal dates to approximately two-thirds of the certificate lifetime to accommodate the shorter validity period. Monitoring vendor advisories for updates and ensuring compatibility with the reduced authorization reuse periods is also recommended. Since this is a planned change with vendor guidance, no emergency action is required.