Let's Encrypt cuts certificate lifetimes to 64 days from February
Staging switches on 14 October to let operators test first. Hardcoded renewal schedules are the thing most likely to break when production follows in February 2027.
Let’s Encrypt announced on 7 October that it is cutting default certificate lifetimes from 90 days to 64, effective 10 February 2027. The last 90-day certificate it issues is expected to expire by 11 May 2027. Anyone who wants shorter still has the option of 45-day or 6-day certificates, available since the earlier rollout announced last December.
The authorization reuse window — how long a domain-control check stays valid before it must be repeated — shrinks from 30 days to 10 at the same time, then to seven hours in 2028. Let’s Encrypt is testing the water first: its staging environment switches to 64-day certificates on 14 October 2026, five days from now, specifically so operators can catch problems before production follows.
Why it matters: this breaks anything that assumes a 90-day cycle. Let’s Encrypt’s own advice is to search cron jobs and renewal scripts for hardcoded values like 83, 80 or 60, and switch to renewing at roughly two-thirds of the certificate’s lifetime instead — about 43 days for the new default. If your ACME client supports ACME Renewal Information (ARI), it already handles this timing for you.
The caveat: rate limits and issuance chains aren’t changing, so this is a renewal-cadence problem, not a capacity one. Test against staging after 14 October if you’re not confident your setup renews automatically.