Let’s Encrypt, the nonprofit certificate authority, will shorten the default lifetime of the website certificates it issues from 90 days to 64 days starting Feb. 10, 2027, SecurityWeek reported Monday. The change, which Let’s Encrypt announced Oct. 7, is the midpoint on its way to 45-day certificates in 2028, and it leaves organizations that still renew certificates by hand or on fixed timetables less room before an expired certificate takes a site or service offline.

A TLS certificate is the digital credential that lets a browser or app confirm it is talking to the real website and encrypt the connection. Each one carries an expiry date. When it lapses without being replaced, browsers show security warnings and automated connections between systems can fail.

What Happened

In a blog post titled “64-Day Certificate Lifetimes Coming Feb 2027,” Let’s Encrypt said every certificate issued or renewed on or after Feb. 10 will be valid for 64 days unless the customer has chosen a shorter option. It will begin issuing 64-day certificates in its staging environment, a test system, on Oct. 14 so operators can try them first. Existing certificates will not be revoked, and the last 90-day certificates are expected to expire around May 11, 2027.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

Customers can already opt into 45-day or six-day certificates. Let’s Encrypt said its ACME endpoints, the addresses that automated renewal software contacts, along with its certificate chains and rate limits, are unchanged.

A second change is less visible. “Authorization reuse,” the period during which Let’s Encrypt accepts an earlier proof that a customer controls a domain without checking again, will shrink from 30 days to 10 days and then to seven hours in 2028. The organization said this prepares for a 2029 cut in the maximum reuse periods allowed for certificate authorities and removes the need for “CAA rechecking,” a repeat of part of the validation process when the earlier check is more than seven hours old.

Why It Matters

The main risk is renewal tooling built around the 90-day cycle. Let’s Encrypt said software that supports ACME Renewal Information (ARI), a feature that lets the certificate authority tell the client when to renew, should need no changes. Setups that renew a fixed number of days before expiry should instead renew at roughly two-thirds of a certificate’s lifetime. The organization suggested searching cron jobs, wrapper scripts and runbooks for hard-coded values such as 83, 80 or 60 days, automating the reloading of renewed certificates and adding alerts for failed renewals.

For leaders, the question is whether anyone knows where all the organization’s certificates are and how each is renewed. Let’s Encrypt’s December 2025 post, “Decreasing Certificate Lifetimes to 45 Days,” discourages manual renewal outright. With each cut, a renewal process that depends on someone remembering a date becomes more likely to cause an outage.

Let’s Encrypt said shorter lifetimes reduce the risk from key compromise and from certificates issued in error, because a bad certificate stays valid for less time.

The Industry Schedule

Let’s Encrypt is not acting alone. In April 2025 the CA/Browser Forum, the body of certificate authorities and browser makers that sets rules for publicly trusted certificates, approved a ballot to reduce the maximum validity of such certificates from 398 days to 47 days in stages between March 2026 and March 2029. Apple, Google, Microsoft and Mozilla voted for it, and no certificate issuer voted against. Let’s Encrypt said all publicly trusted certificate authorities are making similar changes, so organizations that buy certificates from commercial providers face the same pressure.

The December post also described DNS-PERSIST-01, a new validation method being standardized with the CA/Browser Forum and the Internet Engineering Task Force. It lets a domain owner set up a DNS record once rather than changing it at every renewal, which Let’s Encrypt said should reduce reliance on authorization reuse.

What to Watch

Testing in the staging environment opens Oct. 14, and the production default changes Feb. 10, 2027. Under the schedule in the December post, the default moves to 45 days with seven-hour authorization reuse on Feb. 16, 2028. Watch for the arrival of DNS-PERSIST-01, which Let’s Encrypt expected in 2026, and for renewal failures as the first 64-day certificates come due in spring 2027.