Policy · 1 day ago
Let's Encrypt said it will cut free SSL/TLS certificate lifetimes from 90 days to 64 days starting February 10, 2027, with testing for the shorter certificates opening October 14, 2026. The change is meant to push ACME users toward renewal automation, especially clients that support ARI (ACME Renewal Information).
The failure point is not issuance; it is renewal logic that assumes a fixed calendar, such as scripts that always renew at day 60 or teams that still renew by hand. Once certificates expire sooner, those setups can miss the window and let a valid site certificate lapse, which means avoidable TLS outages.
For teams running Let's Encrypt in production, the exposure sits in the automation layer they already trust. If their certificate handling depends on a hardcoded offset instead of listening to the issuer's renewal signal, the shorter lifetime turns a routine admin process into a source of downtime.
3 sources covering this story
Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch
Beginning February 2027, all newly issued certificates will have a 64-day validity period by default.
Let’s Encrypt moves to a 64-day default certificate lifetime on February 10, 2027, and admins with hardcoded renewals need to update them.
Let's Encrypt cuts certificate lifetimes to 64 days starting February 2027
Free SSL/TLS certificate lifetimes reduce to 64 days in February.
Part of the PlainSec briefing for 2026-10-13