Reported by 3 outlets
Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 1.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.29 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 1.4 / 10 = base × recency + community
Desk analysis
Let's Encrypt is moving to 64-day default certificate lifetimes starting February 10, 2027, with staging tests opening October 14, 2026. The change is an intermediate step before a 45-day default planned for 2028, aligning with CA/Browser Forum Baseline Requirements that will apply to all publicly trusted CAs. The last 90-day certificate is expected to expire on May 11, 2027; authorization reuse shrinks from 30 days to 10 days now, then to seven hours in 2028.
Defenders should treat this as an automation stress test, not a headline attack. Any organization with hardcoded renewal windows like 83, 80, or 60 days in cron jobs, wrapper scripts, or runbooks risks service outage once 64-day certificates enter production. The events cite ARI support as the preferred path: clients that implement ACME Renewal Info will receive renewal prompts from Let's Encrypt automatically, while others must shift to renewing at roughly two-thirds of lifetime. Staging testing is explicitly recommended before February 2027.
Now is the time to audit renewal logic and test in staging. Search for static renewal thresholds in deployment repositories, verify ACME client documentation for ARI implementation, and add alerting for renewal failures. Network restrictions are minimal because this is a policy change rather than an active exploit, but operators relying on long-lived 90-day certificates for embedded devices or air-gapped systems should plan replacement schedules around the May 11, 2027 expiration boundary.
Watch for the staging rollout on October 14, 2026, and any updates from the CA/Browser Forum that could accelerate the 2028 45-day timeline. A second development to track is whether ACME client vendors complete ARI implementations ahead of production, since gaps there will determine which environments break first.
Timeline
-
original reporting
Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch
securityweek.com · 1d ago · October 12th, 2026
Open Certificate Authority (CA) Let’s Encrypt is taking the first step towards reducing the validity period of the certificates it issues. Beginning February 10, 2027, it will issue certificates with 64-day lifetimes by default, in preparation for 45-day lifetimes planned for 2028. In line with the CA/Browser Forum Baseline Requirements, the shorter certificate validity period is expected to improve security on the web by making revocation more efficient and limiting the scope of compromise. All publicly trusted CAs will make similar changes, Let’s Encrypt noted in a December 2025 blog, when it revealed the planned timeline for switching to 45-day certificates. Last week, the CA announced that, after February 10, 2027, all newly issued or renewed certificates will have a 64-day validity period, with the last 90-day certificate expected to expire on May 11, 2027. This week, Let’s Encrypt will start issuing 64-day certificates in its staging environment for testing purposes, and recommends that all customers perform similar tests before the change enters production. “If your renewals are automated and your client supports ACME Renewal Info (ARI), you should be all set since ARI allows Let’s Encrypt to tell your client when to renew (you can review your ACME client’s documentation to determine if ARI is implemented),” Let’s Encrypt notes. For certificates with renewals hardcoded to a specific date from expiration, the CA recommends sett
-
update from letsencrypt.org
Decreasing Certificate Lifetimes to 45 Days
letsencrypt.org · 316d ago · December 2nd, 2025
In a December 2025 post, Let's Encrypt laid out the industry-wide timeline: current 90-day certificates will be cut in half to 45 days by 2028 per CA/Browser Forum Baseline Requirements.
-
update from letsencrypt.org
64-Day Certificate Lifetimes Coming Feb 2027
letsencrypt.org · 7d ago · October 7th, 2026
The final 90-day certificates are expected to expire May 11, 2027, and authorization reuse will shrink from 30 to 10 days ahead of a 2028 45-day default and a 2029 seven-hour reuse limit.
-
update from en.killbait.com
Let's Encrypt to Reduce SSL Certificate Validity Period to 64 Days Starting February 2027 📰 Original title: Let's Encrypt to Cut SSL Certifi
en.killbait.com · 1d ago · October 12th, 2026
Let's Encrypt to Reduce SSL Certificate Validity Period to 64 Days Starting February 2027 📰 Original title: Let's Encrypt to Cut SSL Certifi
via Mastodon https://en.killbait.com/let-s-encrypt-to-reduce-ssl-certificate-validity-period-to-64-days-starting-february-2027.html?utm_source=mastodon_social&utm_medium=social&utm_campaign=killbait.mastodon_social