Let’s Encrypt Prepares for Shorter Certificate Lifetimes, Reduces Default Validity to 64 Days
In a move aimed at improving online security, Let’s Encrypt, one of the world’s largest certificate authorities, is cutting the default validity period of its issued certificates from 90 days to 64 days. This change, set to take effect on February 10, 2027, is part of the organization’s plan to eventually switch to 45-day certificates, as mandated by the CA/Browser Forum Baseline Requirements.
The reduction in certificate lifetime will make it more efficient for authorities to revoke compromised or expired certificates, thus limiting the scope of potential breaches. This change will also be adopted by all other publicly trusted Certificate Authorities (CAs), as announced by Let’s Encrypt last year. By shortening the validity period, CAs can respond faster to emerging security threats and reduce the window of vulnerability for attackers.
Let’s Encrypt has been testing its 64-day certificate issuance in a staging environment since this week. The organization recommends that all customers perform similar tests before the change takes effect. Those with automated renewal processes will likely not be affected, as the new certificates can still be renewed automatically using ACME (Automated Certificate Management Environment) protocols.
For those whose renewals are hardcoded to specific dates from expiration, Let’s Encrypt suggests adjusting the renewal date to approximately two-thirds of the certificate lifetime. This will ensure a smooth transition and prevent any potential disruptions to services.
In addition to reducing default certificate validity, Let’s Encrypt is also planning to decrease its authorization reuse period from 10 days to seven hours in 2028. This change aims to remove the need for repeated validation processes, known as “CAA rechecking,” which can cause delays in issuing new certificates.
The shift towards shorter certificate lifetimes and reduced authorization reuse periods will have a significant impact on the way online security is managed. As more organizations move towards adopting these changes, they should be prepared to adapt their renewal and management processes accordingly. By staying informed about upcoming changes and taking proactive steps, businesses can minimize potential disruptions and maintain robust online security.
To ensure a seamless transition, it’s essential for certificate holders to review and update their automated renewal processes to accommodate the new 64-day certificate validity period. This includes verifying that their ACME client supports Renewal Information (ARI) and that their certificates are set up to automatically renew. By taking these precautions, organizations can stay ahead of emerging security threats and maintain a secure online presence.
Source: SecurityWeek — 2026-10-12