Let’s Encrypt Cuts Default Certificate Validity to 64 Days
Open Certificate Authority Let’s Encrypt has announced a transition to shorter default certificate lifetimes, beginning with a 64-day validity period in early 2027 as a stepping stone toward a 45-day standard.
Radwan AbdulhadiEditor and technology writer
Transitioning to Shorter Certificate Lifetimes
Open Certificate Authority (CA) Let’s Encrypt is preparing to take its first major step toward reducing the validity period of the security certificates it issues. According to details [noted](https://letsencrypt.org/2025/12/02/from-90-to-45) in a previous update, all publicly trusted CAs are aligning with updated requirements to enhance web security.
Beginning February 10, 2027, the organization will officially issue certificates featuring a 64-day lifetime by default. This adjustment functions as an intermediary phase in preparation for full 45-day lifetimes, which are currently scheduled to be implemented in 2028.
Security Benefits and Industry Alignment
The implementation of shorter certificate validity periods aligns directly with the CA/Browser Forum Baseline Requirements. Industry experts anticipate that shrinking certificate lifespans will significantly improve overall security across the web.
By shortening these windows, organizations can make certificate revocation substantially more efficient while simultaneously limiting the potential scope of any security compromise. Similar shifts toward reduced validity are being adopted across the broader certificate authority ecosystem.
Timeline and Staging Environment Testing
As [announced](https://letsencrypt.org/2026/10/07/64-day-certs.html) by the organization, the last traditional 90-day certificate issued under the older schedule is expected to fully expire on May 11, 2027. To help administrators prepare, testing environments are being updated.
Let’s Encrypt has initiated the issuance of 64-day certificates within its staging environment to facilitate proper testing. The CA strongly recommends that all customers perform comprehensive testing ahead of the production rollout.
Automation and Renewal Guidelines for Clients
Managing shorter certificate lifespans efficiently relies heavily on automation. Let’s Encrypt explains that if client renewals are fully automated and support ACME Renewal Info (ARI), systems should seamlessly adapt to the new schedule.
The ARI protocol allows Let’s Encrypt to instruct connected clients on the optimal timing for renewals. For environments utilizing hardcoded renewal dates relative to expiration, the CA advises configuring those dates to approximately two-thirds of the total certificate lifetime.
Authorization Reuse and Validation Adjustments
In addition to altering certificate lifetimes, Let’s Encrypt plans to reduce the authorization reuse period down to 10 days next year. A further reduction to just seven hours is slated for 2028.
These additional modifications are designed to maintain compliance with upcoming reductions in maximum validation reuse periods planned for 2029. Furthermore, the adjustments help eliminate the operational necessity for repetitive CAA rechecking when validation data ages beyond acceptable thresholds.
Sources
- SecurityWeekLet’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch
Continue chronologically
Related stories
Meta Introduces NTS Support for Public Time Service
Meta has updated its public time service to support Network Time Security (NTS), bringing cryptographic authentication and verifiability to internet time synchronization.
Cloudflare Announces Intent to Become a Public Certificate Authority
Cloudflare is applying to become a public certificate authority, combining an established root, an ACME-first approach, and Merkle Tree Certificates.
GitHub Actions to Block pull_request_target by Default
GitHub Actions will block pull_request_target events by default in public repositories starting December 2, 2026, enhancing security.
Specializing SLM Vocabularies Cuts Inference Cost by 77%
A new vocabulary specialization method called VocabX cuts small language model inference costs by 77% in production environments without base model changes.
