Blog
2 min read

Let's Encrypt Moves to 64-Day Certificates in February 2027

Let's Encrypt announced on 7 October 2026 that certificates issued from 10 February 2027 will last 64 days by default instead of 90, with staging switching on 14 October 2026. Authorization reuse drops from 30 to 10 days. Why it's happening, who it breaks (hard-coded renewal schedules), and how to check your setup.

Let's Encrypt announced on 7 October 2026 that its default certificate lifetime will drop from 90 days to 64 days. It's the next step on the road to 45-day certificates in 2028.

The dates

Date What happens
14 October 2026 The staging environment starts issuing 64-day certificates for testing
10 February 2027 Production default becomes 64 days for every new or renewed certificate
11 May 2027 The last 90-day certificates expire
2028 Default expected to drop to 45 days; authorization reuse to seven hours

Subscribers can still opt into even shorter lifetimes (45 or 6 days). Valid certificates won't be revoked as part of the change. Rate limits, ACME endpoints and issuance chains don't change.

Authorization reuse also shrinks

Once you prove you control a domain, Let's Encrypt reuses that validation for later certificates. That period drops from 30 days to 10 days, and to seven hours in 2028. Most ACME clients don't notice; only clients built to rely on validation reuse need changes.

Why

Shorter lifetimes limit the damage if a private key leaks or a certificate is mis-issued, and they push the whole ecosystem toward full automation. Browser and CA rules are moving the same way industry-wide. (What Is an SSL Certificate?)

Who it breaks

Anything with a hard-coded renewal schedule. A cron job that renews "30 days before expiry", or "every 60 days", was fine for 90-day certificates. With 64-day certificates, "renew every 60 days" leaves a four-day margin — one failed run and your site shows a certificate error.

Let's Encrypt's guidance: renew at about two-thirds of the lifetime, and search your cron jobs, scripts and runbooks for hard-coded values like 83, 80 or 60 days.

What to check

  1. Does your ACME client support ARI (ACME Renewal Information)? If so, Let's Encrypt tells it when to renew and you don't need to change anything. Current Certbot, Caddy, Traefik and most hosting platforms handle renewal timing automatically. (How Automatic SSL Works, Caddy vs Nginx vs Traefik)
  2. Hard-coded schedules? Replace them with ARI-driven or two-thirds-lifetime renewal.
  3. Reloads: make sure the web server actually reloads after renewal — a renewed certificate on disk does nothing if Nginx is still serving the old one. (Certbot and Let's Encrypt)
  4. Alert on renewal failures rather than discovering them when the certificate expires. (Know When Your App Is Down)
  5. Test against staging after 14 October if you run your own ACME tooling.

If you're on a managed host that handles HTTPS for you, there's likely nothing to do.

Source: Let's Encrypt: 64-Day Certificate Lifetimes Coming Feb 2027

EasySpawn issues and renews certificates for your domains automatically, so shorter lifetimes are our problem, not yours. See how it works or join the waitlist.

Related: What Is HTTPS? · Your Connection Is Not Private · ERR_SSL_PROTOCOL_ERROR · TLS Handshake Explained

Keep reading