Let's Encrypt will issue 64-day certificates by default from February 2027
The change is a step toward 45-day certificates in 2028. Testing in the staging environment starts October 14.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
Let's Encrypt will shorten the default life of its TLS certificates from 90 days to 64 days starting February 10, 2027. After that date, every newly issued or renewed certificate will be valid for 64 days. The free certificate authority expects the last 90-day certificate to expire on May 11, 2027, and says it will not revoke any valid certificates during the switch. The change prepares for default 45-day certificates in 2028, in line with the CA/Browser Forum Baseline Requirements. Let's Encrypt has said all publicly trusted certificate authorities will make similar changes. Sarah Gran of the Internet Security Research Group, the nonprofit that runs Let's Encrypt, said shorter lifetimes reduce the risk of key compromise and mis-issuance. Let's Encrypt will start issuing 64-day certificates in its staging environment on October 14, 2026, and recommends that customers test there first. Sites whose renewals are automated through a client that supports ACME Renewal Info should not need to change anything. Setups with fixed renewal schedules or manual renewals will need checking. Subscribers already using the optional 45-day or 6-day certificates are not affected.