Pull to refresh
Logo
Let's Encrypt cuts default certificate lifetime to 64 days

Let's Encrypt cuts default certificate lifetime to 64 days

Rule Changes

First reduction in the CA's history, stepping toward 45-day certificates in 2028

6 days ago: Let's Encrypt announces 64-day default

Overview

Updated 2 hours ago

Let's Encrypt will cut its default certificate lifetime from 90 days to 64 days starting February 10, 2027. It's the first reduction in the nonprofit certificate authority's history, and a step toward 45-day certificates in 2028.

The change affects every website using Let's Encrypt's free certificates. Renewals that run on fixed schedules will need updating, or certificates will expire before they're renewed.

Why it matters

Websites that don't automate certificate renewal will need to renew more often, and hard-coded renewal schedules will break.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

64 days
New default certificate lifetime
Down from 90 days, starting February 10, 2027.
45 days
2028 default lifetime
Planned default starting February 16, 2028.
10 days
Authorization reuse period
Down from 30 days, starting February 10, 2027.
90 days
Current default lifetime
The standard since Let's Encrypt launched in 2015.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Sign up to generate historical perspectives on this story.

Organizations Involved

Timeline

December 2015 February 2028

9 events Latest: 6 days ago
Tap a bar to jump to that date
  1. Default drops to 45 days

    Upcoming Policy Change

    Let's Encrypt's default lifetime falls to 45 days. Authorization reuse drops to 7 hours.

  2. Last 90-day certificate expires

    Upcoming Milestone

    Let's Encrypt expects the final 90-day certificate to expire, completing the transition to 64-day lifetimes.

  3. CA/Browser Forum maximum drops to 100 days

    Upcoming Regulation

    The Forum's ceiling on certificate lifetime falls to 100 days for all publicly trusted CAs.

  4. Production default drops to 64 days

    Upcoming Policy Change

    All new and renewed certificates get 64-day lifetimes. Authorization reuse drops from 30 days to 10 days.

  5. Staging starts issuing 64-day certificates

    Upcoming Testing

    Let's Encrypt's staging environment begins issuing 64-day certificates so subscribers can test before production changes.

  6. Let's Encrypt announces 64-day default

    Latest Announcement

    Let's Encrypt says all certificates issued on or after February 10, 2027 will have 64-day lifetimes by default.

  7. CA/Browser Forum caps lifetime at 200 days

    Regulation

    Ballot SC-081 takes effect, setting the maximum certificate lifetime at 200 days for all publicly trusted CAs.

  8. Let's Encrypt reveals 45-day plan

    Announcement

    Let's Encrypt announces its planned timeline for switching to 45-day certificates, citing CA/Browser Forum requirements.

  9. Let's Encrypt launches public beta

    Launch

    Let's Encrypt begins issuing free certificates with 90-day lifetimes, when three-year certificates were the norm.

Scenarios

1

Automated renewals carry the transition

Likely Resolves by May 11, 2027

Discussed by: Let's Encrypt, Ars Technica

Most renewals run through ACME clients, and clients supporting ARI (ACME Renewal Information) will renew when Let's Encrypt tells them to. Fixed schedules renewing at 60 days will still catch 64-day certificates before expiry. Let's Encrypt expects a smooth transition and says rate limits and issuance chains are unaffected.

2

Hard-coded renewal schedules miss the window

Possible Resolves by May 11, 2027

Discussed by: Scott Helme, SXZ.io

Renewals hardcoded to run at 60 days before expiry will still catch 64-day certificates. Schedules renewing at 80 or 83 days will miss. Let's Encrypt recommends grepping for hardcoded numbers like 83, 80, and 60 in cron jobs and runbooks, and renewing at roughly two-thirds of the lifetime, or 42 days for 64-day certificates.

3

45-day default arrives on schedule in 2028

Likely Resolves by Feb 16, 2028

Discussed by: Let's Encrypt, SecurityWeek

Let's Encrypt has committed to a 45-day default on February 16, 2028, ahead of the CA/Browser Forum's 47-day ceiling in March 2029. Authorization reuse drops to 7 hours at the same time. The 64-day step is designed to ease subscribers into this shorter cadence.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

December 2015

Let's Encrypt launches with 90-day certificates (2015)

Let's Encrypt launched its public beta in December 2015, issuing free certificates valid for 90 days. Commercial certificates at the time commonly lasted three years.

Then

The 90-day lifetime became the norm for automated certificate management.

Now

It proved short lifetimes with automated renewal could work at scale, setting the stage for further cuts.

Why this matters now

The 64-day change is the first reduction to that 90-day default, applying the same logic: shorter lifetimes limit the damage of key compromise.

2025

CA/Browser Forum Ballot SC-081 (2025)

The CA/Browser Forum passed Ballot SC-081, setting a schedule that cuts the maximum certificate lifetime from 398 days to 200 days in March 2026, 100 days in March 2027, and 47 days in March 2029.

Then

All publicly trusted certificate authorities must comply with the new ceilings.

Now

The industry is moving toward much shorter certificate lifetimes across the board.

Why this matters now

Let's Encrypt's 64-day step is voluntary and ahead of the Forum's schedule, but it's part of the same industry-wide shift.

Sources

(8)