Let's Encrypt Will Shorten Certificate Lifetimes to 64 Days
The transition to shorter security windows will arrive in 2027 to mandate automated renewal cycles.
Updated on Oct. 8, 2026 in Cybersecurity
Live Poll
Do you support mandatory updates to automate web security and shorten certificate lifespans?
Starting February 10, 2027, Let's Encrypt will reduce the standard lifespan of its SSL/TLS certificates from 90 days to 64 days. This change is part of an ongoing effort to tighten security protocols and force the adoption of automated renewal systems.
Why it matters
Shorter certificate lifespans minimize the window of opportunity for attackers should a credential be compromised or improperly issued. This shift accelerates the industry migration away from manual maintenance toward fully automated cryptographic lifecycles.
The new 64-day certificate limit represents a significant reduction from the current 90-day standard. Additionally, the authorization reuse period will be slashed from 30 days to 10 days, with further reductions to seven hours planned by 2028.
The players
Let's Encrypt
A non-profit certificate authority that provides free X.509 certificates for Transport Layer Security encryption to promote a secure and privacy-respecting web.
The details
Operators must configure their infrastructure to support ACME (Automated Certificate Management Environment) Renewal Information, a protocol extension that assists clients in determining when to request a new certificate. Because lifespans are shrinking, administrators must update any hardcoded renewal schedules that currently rely on the 90-day cycle. This process ensures that web servers can maintain valid TLS (Transport Layer Security) encryption without requiring manual intervention, which was standard practice when certificates lasted one to three years before the service launched in 2016.
Timeline
early 2016: Let's Encrypt service launched.
October 14, 2026: Testing period for 64-day certificates begins.
February 10, 2027: Official rollout of 64-day certificate limit.
2028: Planned rollout of 45-day certificate defaults and seven-hour authorization reuse.
The Tech Race
This policy change further distances the industry from the era of manual certificate management that preceded the 2016 launch of Let's Encrypt. It marks a clear progression toward a hyper-automated security model that will eventually reach 45-day defaults by 2028.
Developers and systems administrators must update their ACME client software and automated renewal scripts before February 10, 2027. Failure to adapt may result in service disruptions as certificates will expire significantly faster than the current 90-day cadence.
The takeaway
The move to 64-day certificates is a definitive step toward making manual certificate handling obsolete. Watch for the October 14, 2026, test phase, as it will reveal how existing client software handles the compressed renewal interval.
Further reading
For broader trends in identity verification and encryption standards, see the Cybersecurity section.
Live Poll
Do you support mandatory updates to automate web security and shorten certificate lifespans?
