LET’S Encrypt will begin issuing certificates with a 64-day validity period by default from 10 February 2027, as a preparatory step toward the 45-day lifetimes planned for 2028. The change aligns with the CA/Browser Forum Baseline Requirements and is intended to improve web security by speeding revocation and narrowing the window of compromise.
The move applies to all newly issued or renewed publicly trusted certificates by Let’s Encrypt, with the last 90-day certificate set to expire on 11 May 2027. Let’s Encrypt has started issuing 64-day certificates in its staging environment for testing, and it urges customers to perform similar tests before production deployment. The CA notes that the adjustment will not affect ACME endpoints, issuance chains, or rate limits.
In addition, the organization plans to reduce the authorization reuse period to 10 days next year, eventually to seven hours in 2028, to comply with a forthcoming 2029 reduction in maximum validation reuse periods and to remove the need for repeated validation data if it becomes too old.
Practically, organisations should ensure their ACME clients support ARI (ACME Renewal Info) so renewals can be scheduled accurately. For renewals with hardcoded dates, Let’s Encrypt recommends setting renewal dates to roughly two-thirds of the certificate’s lifetime. Until production, administrators are advised to test renewal workflows in staging and adjust client configurations accordingly.