Let's Encrypt's 64-day default certificate lifetime

Let's Encrypt announced on 7 October that certificates issued or renewed from 10 February 2027 will have a default lifetime of 64 days instead of 90. The last 90-day certificates are expected to expire on 11 May 2027, and valid certificates will not be revoked. The announcement only asks things of people running sites and self-hosted services, and says nothing to ordinary visitors.

The staging environment switches to 64-day certificates on 14 October, and Let's Encrypt recommends testing there first. Under its December 2025 announcement, the default drops again to 45 days on 16 February 2028, and anyone who wants to move early can already choose a 45-day or 6-day profile (a named set of certificate settings requested at issuance).

Let's Encrypt says shorter lifetimes reduce the risk of key compromise and mis-issuance. A ballot passed in April 2025 by the CA/Browser Forum, where certificate authorities and browser makers set the rules for certificates, cuts the maximum lifetime from 398 days in steps: 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Since 64 days is shorter than the 2027 cap, our reading of the two announcements is that it is an intermediate step Let's Encrypt chose before the 47-day limit arrives.

Perspective

A certificate proves that a site is who it claims to be, and a leaked key or mis-issued certificate can be used to impersonate the site until it expires. Shorter lifetimes shrink that window, which, according to Let's Encrypt's 2015 explanation, was one of its reasons for choosing 90 days. The cost is more frequent renewal: a February post expects daily renewal requests to double once lifetimes reach 45 days. The December 2025 announcement advises against manual renewal, and rate limits are not affected.

The software that requests and renews certificates is called an ACME client, such as Certbot. If renewal is automated and the client supports ARI (ACME Renewal Information, which lets the certificate authority tell the client when to renew, published as RFC 9773 in 2025), the announcement says no change is needed, and Certbot has checked ARI by default since version 4.1.0 in June 2025. Let's Encrypt recommends that anyone who hard-coded renewal at a fixed number of days switch to renewing at about two-thirds of the lifetime, and suggests searching cron jobs, scripts and runbooks for numbers such as 83, 80 or 60 if unsure.

Certificate authorities in Asia have announced their own changes for the CA/Browser Forum caps, and the three announcements we read do not mention Let's Encrypt's 64 days. Taiwan Certificate Authority (TWCA) set a 198-day lifetime from 9 March 2026, meaning two applications a year, and Japan Registry Services (JPRS) cut its server certificates from one year to five months from 18 February 2026 while leaving its ACME-based service unchanged. In South Korea, Korea Information Certificate Authority (KICA), which sells Sectigo certificates, published the CA/Browser Forum schedule in April 2025. TWCA and JPRS were among the five certificate issuers that abstained in the 2025 ballot.

Site operators using Let's Encrypt can check now whether their client supports ARI, run a renewal against staging after 14 October and, as the announcement suggests, add alerts for failed renewals. The announcement says nothing specific about devices that only accept certificates uploaded through a web interface. By our count, using each certificate for the full 64 days still means six replacements a year, or about nine if renewed at two-thirds as recommended, and Let's Encrypt's client list explains that it leaves out in-browser ACME clients because they encourage manual renewal, which increases the risk of missed renewals.