Let’s Encrypt, one of the world’s largest certificate authorities, is taking a significant step towards improving web security by reducing the default validity period of its issued certificates. Starting February 10, 2027, Let’s Encrypt will issue certificates with a 64-day lifetime, marking a crucial move in preparation for an even shorter lifespan of just 45 days planned for 2028.
The change is aimed at enhancing security on the web by making revocation more efficient and limiting the scope of potential compromises. As part of this effort, all publicly trusted certificate authorities will adopt similar measures, as outlined in the CA/Browser Forum Baseline Requirements. This shift towards shorter-lived certificates aligns with industry best practices, designed to reduce the attack window for malicious actors.
Let’s Encrypt has been at the forefront of this change since December 2025, when it announced its plan to switch to 45-day certificates by 2028. The CA is now taking a step back to ensure a smooth transition, starting by issuing 64-day certificates in its staging environment for testing purposes. This allows customers to perform similar tests and update their infrastructure before the change enters production.
For users who rely on automated certificate renewals, Let’s Encrypt notes that they should be unaffected, as long as their clients support ACME Renewal Info (ARI). However, those with hardcoded renewal dates will need to adjust them to approximately two-thirds of the new certificate lifetime. This minor tweak is crucial in ensuring a seamless transition.
In addition to reducing the certificate validity period, Let’s Encrypt will also lower its authorization reuse period to 10 days next year and further reduce it to just seven hours in 2028. This move aligns with upcoming changes in the CA/Browser Forum Baseline Requirements, which will see maximum validation reuse periods reduced by 2029.
Fortunately, this change will not impact ACME endpoints, issuance chains, or rate limits, minimizing disruptions for users. As Let’s Encrypt continues to push the boundaries of web security, its efforts are set to have a lasting impact on the industry. By prioritizing shorter-lived certificates and enhanced validation processes, the CA is sending a clear message that security should be the top priority in today’s digital landscape.
As you prepare for this transition, take note of Let’s Encrypt’s recommendations for updating your infrastructure. Review your ACME client documentation to ensure it supports ARI, and adjust hardcoded renewal dates as necessary. By taking these simple steps, you can ensure a smooth transition and reap the benefits of improved web security offered by Let’s Encrypt’s latest changes.
Source: SecurityWeek — 2026-10-12