Let’s Encrypt has announced a shift to 64-day TLS certificates starting in February of 2027 as part of the organization’s efforts to reduce the risk of key compromise.
“All Let’s Encrypt subscribers will move to certificates with 64-day lifetimes by default unless they select an even shorter lifetime (45 or 6 days),” says Sarah Gran in the announcement. The switch from 90- to 64-day certificates has already started in the staging environment to allow time for testing before the change takes effect in production.
If your renewals are automated and your client supports ACME Renewal Info (ARI), no action should be needed, Gran notes. However, “if your renewals are hard-coded to a date from expiration you should update them to renew at approximately ⅔ of the lifetime instead.” This change will lay the groundwork for 45-day certificate lifetimes coming in 2028.
More information on how to prepare for shortened certificate lifetimes can be found at Let’s Encrypt.
