Policy & Regulation

Let's Encrypt shortens certificate lifetimes to 64 days

Let's Encrypt said it will cut free SSL/TLS certificate lifetimes from 90 days to 64 days starting February 10, 2027, with testing for the shorter certificates opening October 14, 2026. The change is meant to push ACME users toward renewal automation, especially clients that support ARI (ACME Renewal Information).

The failure point is not issuance; it is renewal logic that assumes a fixed calendar, such as scripts that always renew at day 60 or teams that still renew by hand. Once certificates expire sooner, those setups can miss the window and let a valid site certificate lapse, which means avoidable TLS outages.

For teams running Let's Encrypt in production, the exposure sits in the automation layer they already trust. If their certificate handling depends on a hardcoded offset instead of listening to the issuer's renewal signal, the shorter lifetime turns a routine admin process into a source of downtime.

3 sources · Oct 12

Timeline

• Oct 12 Reported by SecurityWeek
• Oct 8 Reported by Ars Technica Security

Sources

• Oct 12 SecurityWeek

  Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch

  Beginning February 2027, all newly issued certificates will have a 64-day validity period by default.

  original

• Oct 12 Help Net Security

  Let’s Encrypt TLS certificate lifetimes to drop from 90 to 64 days starting February 2027 - Help Net Security

  Let’s Encrypt moves to a 64-day default certificate lifetime on February 10, 2027, and admins with hardcoded renewals need to update them.

  original

• Oct 8 Ars Technica Security

  Let's Encrypt cuts certificate lifetimes to 64 days starting February 2027

  Free SSL/TLS certificate lifetimes reduce to 64 days in February.

  original

Part of the PlainSec briefing for 2026-10-12

Every edition of this story: Let's Encrypt shortens certificate lifetimes to 64 days