Security Tightens: Let’s Encrypt Will Cap Certificate Validity at 45 Days by 2028

According to the CA/Browser Forum, the maximum validity of digital certificates was reduced from 398 days to 45 days, with a slightly longer limit of 47 days agreed during discussion. Let’s Encrypt has announced that it will gradually shorten certificate lifetimes to comply with the forum’s baseline requirements, with a plan to cap all publicly trusted certificates at 45 days by 2028.

The transition will occur in three steps: starting 13 May 2026, the tlsserver ACME profile will switch to a 45-day certificate validity for testing; from 10 February 2027, the default “classic” ACME profile will move to a 64-day validity and a 10-day authorization reuse period; and from 16 February 2028, the default profile will adopt a 45-day validity, making this the maximum lifetime for all newly issued certificates.

Today, once a domain is validated, it may be used to obtain certificates for up to 30 days, and by 2028 that window will shrink to 7 hours. Administrators are advised to align renewal practices with the 45-day lifetime and consider ARI to signal renewals where supported.