The 45-Day Era Begins: Let’s Encrypt Unveils Generation Y Hierarchy and IP-Based TLS

Free certificate authority Let’s Encrypt has announced a transition from the X-generation root certificate hierarchy to a Y-generation certificate architecture, introducing two new root CA certificates and six intermediate certificates that will be cross-signed by X1 and X2. From a client trust perspective, Y-generation certificates are functionally equivalent to X-generation ones, with the notable exception that some legacy Android versions may not recognise the new hierarchy.

The firm’s ACME profiles are undergoing a transitional adjustment, and as of 13 May 2026 they will default to the new Y-generation certificate chain, though the TLS client authentication extended key usage will not be included in the new intermediate certificates due to forthcoming root program requirements, according to CA/Browser Forum guidance.

Beginning in February 2026, Let’s Encrypt will discontinue support for TLS client authentication, with the tlsclient profile allowed until May 2026 to aid migration to the Y-generation hierarchy. Early adopters will soon receive Y-generation certificates, and the rollout also enables certificates issued directly to IP addresses, allowing TLS certificates to be obtained without domain names.

By design, certificates will carry a maximum validity of 45 days from launch, with 2027 set to default to 64 days and a planned reduction to 45 days again in 2028, while the broader industry cap remains 47 days.