Let's Encrypt cuts certificate lifetimes to 64 days starting February 2027

Let's Encrypt is reducing the validity period of its free SSL/TLS certificates from 90 days to 64 days, effective February 10, 2027. This move is intended to further improve web security.

The organization states that administrators already using modern ACME clients that support ARI (ACME Renewal Information) should experience a seamless transition. However, those relying on hardcoded renewal schedules or manual processes will need to update their systems before next winter to prevent unexpected certificate expirations.

Starting October 14, 2026, Let's Encrypt will begin testing the 64-day certificates. Interested users will have the option to opt-in to test their setups before the change goes live for all.

Prior to Let's Encrypt's launch in early 2016, certificates were often issued for one to three years. The service initially introduced 90-day certificates to encourage the automation of renewals, which was not widespread at the time. Shorter certificate lifetimes have been credited with limiting vulnerabilities from compromised private keys and accelerating the adoption of HTTPS across the internet.