The Bottom Line

Let's Encrypt is cutting free SSL/TLS certificate lifetimes from 90 days to 64 days. The change takes effect February 10, 2027. Testing begins October 14, 2026, for teams that want to validate their setups early.

For admins running modern ACME clients with ARI support, this is a non-event. For anyone still on hardcoded renewal schedules or manual certificate management, it is a hard deadline. Certificates will start expiring faster, and unprepared systems will break.

This is not a one-off policy tweak. It is the next step in a decade-long campaign to force automation across the web's HTTPS infrastructure.

What Was Announced

Let's Encrypt will reduce its default certificate validity period from 90 days to 64 days starting February 10, 2027. The organization opens a testing window on October 14, 2026, letting interested users opt in and confirm their renewal pipelines handle the shorter window before it becomes mandatory.

The mechanism that makes this painless for most operators is ACME Renewal Information, or ARI. ARI is an extension to the ACME protocol that tells clients exactly when to renew a certificate, rather than relying on a fixed countdown baked into scripts or cron jobs. Admins running ACME clients that already support ARI should see no disruption. The renewal logic adapts automatically to the new 64-day window.

The risk sits with organizations still relying on hardcoded renewal intervals or manual certificate issuance. Those setups assume a 90-day runway. Shrink that window to 64 days without updating the automation, and certificates start expiring before anyone notices.

The move continues a pattern Let's Encrypt set when it launched in early 2016. Before that launch, certificate authorities commonly issued certificates valid for one to three years at a time. Let's Encrypt started with 90-day certificates specifically to force the renewal automation the industry lacked. Shorter validity periods limit the damage from stolen private keys and pushed broader HTTPS adoption across the web. The 64-day shift is the same strategy, applied again.

By the Numbers

Certificate lifetime drops from 90 days to 64 days. The new policy takes effect February 10, 2027. Testing opens October 14, 2026. Prior to Let's Encrypt's 2016 launch, certificates commonly ran for 1 to 3 years.

Competitive Context

The source frames this as a continuation of Let's Encrypt's own history rather than a response to a rival certificate authority. The comparison that matters is internal: 90-day certificates, the standard Let's Encrypt set in 2016, versus the new 64-day standard arriving in 2027. The earlier shift from multi-year certificates to 90 days already reset expectations across the certificate authority industry. This second reduction pushes that same logic further, tightening the automation requirement for anyone still issuing free certificates through Let's Encrypt's infrastructure.

Why It Matters

Shorter certificate lifetimes shrink the attack window if a private key leaks. A stolen key tied to a 64-day certificate expires faster than one tied to a 90-day certificate. That limits how long an attacker can impersonate a service or intercept traffic before the credential dies on its own.

The tradeoff is operational load. Every security gain from shorter lifetimes depends on renewal automation that actually works. Teams running modern ACME clients with ARI support get the security benefit without lifting a finger. Teams running legacy scripts or manual processes face a choice: modernize the renewal pipeline or risk unplanned certificate expiration. Unplanned expiration is not a cosmetic problem. An expired TLS certificate breaks HTTPS connections outright, triggers browser warnings, and can take down API integrations, mobile app backends, and internal services that depend on valid certificates to establish trust.

For security engineers managing certificate inventories, the practical to-do list is short. First, confirm which ACME client issues and renews your organization's certificates. Second, confirm that client supports ARI. Third, if it does not, either upgrade the client or build in a buffer for the February 2027 deadline well ahead of time.

What To Watch

Testing for 64-day certificates opens October 14, 2026. Organizations that want to validate their renewal automation ahead of the production cutover can opt in starting that date. The hard deadline is February 10, 2027, when 64-day certificates become the default for all Let's Encrypt issuance. Anyone still depending on fixed 90-day renewal assumptions should treat next winter as the real deadline, not the February date itself, since legacy systems need lead time to update before certificates start expiring unexpectedly.

Read the source →