Let's Encrypt: 64-day certificates by default from February 10, 2027

Let's Encrypt announced that on February 10, 2027 its default classic ACME profile will start issuing 64-day certificates, with a shorter authorization reuse period. A 45-day profile is already available as opt-in.

What breaks

• Cron jobs that renew every 60 days on a fixed date — a 64-day certificate leaves only a few days of margin.
• Manual renewals and certificates copied by hand to appliances.
• Monitoring that warns only 7 days before expiry.

Example

Illustrative example. Renew when one third of the lifetime is left (about 21 days for 64-day certificates), or use ACME Renewal Information (ARI) if your client supports it.

Before February 2027

• ☐ Inventory every host that uses Let's Encrypt
• ☐ Switch renewal from a fixed date to 'remaining lifetime'
• ☐ Automate certificate deployment to proxies and appliances
• ☐ Alert at 14 days, not 7

Plan the rollout on a simple Gantt chart →

Source: Let's Encrypt, “Decreasing Certificate Lifetimes to 45 Days”, Dec 2, 2025.