Let’s Encrypt Cuts Default Certificate Validity to 64 Days

Why the Change Matters Now

From February 2027 every new certificate issued by Let’s Encrypt will be valid for 64 days unless the requester specifies a different lifetime. This adjustment shortens the current 90‑day default and is a clear signal that the organization is preparing for a future reduction to 45 days. The move aligns with Let’s Encrypt’s long‑term goal of encouraging more frequent renewals, which can reduce the window of exposure if a private key is compromised.

Historical Context of Certificate Lifetimes

For many years the industry standard for TLS certificates was a one‑year validity period. In 2020 major browsers began to distrust certificates longer than 398 days, prompting a shift toward shorter lifespans. Let’s Encrypt popularized the 90‑day model because it fit well with automated renewal tools such as certbot. The shorter window improves security but also raises operational questions for administrators.

Technical Details of the 64 Day Default

The new default is implemented through the ACME protocol, the same standard that Let’s Encrypt uses to issue and manage certificates. The change does not affect the maximum allowed lifetime, which remains 397 days, but it does set the default notAfter field to 64 days from issuance. Existing certificates continue to honor their original expiration dates, and customers can still request longer periods by adding the --validity flag to their ACME client.

How ACME Handles Lifetime Requests

• Clients send a validity parameter in the certificate signing request.
• If omitted, the server applies the default of 64 days.
• The server validates that the requested period does not exceed the maximum allowed.

Impact on Website Operators

Websites that already rely on automated renewal will see little disruption. However, organizations that perform manual renewals or have long‑standing processes built around a 90‑day cycle may need to adjust schedules. The shorter default also means that monitoring tools must be configured to alert administrators sooner before a certificate expires.

Key Adjustments to Consider

1. Review cron jobs or scheduled tasks that trigger renewal.
2. Update documentation to reflect the 64‑day default.
3. Test renewal workflows in a staging environment before the February 2027 rollout.

Automation and Renewal Best Practices

Let’s Encrypt’s philosophy has always been that automation eliminates human error. Operators should ensure that their ACME client runs at least once every 30 days, providing a comfortable buffer before the new 64‑day certificates expire. Using a tool that supports rate‑limit handling can prevent accidental lockouts.

Recommended Monitoring Strategies

• Integrate certificate expiry checks into existing health‑check dashboards.
• Leverage services such as Mozilla Observatory to verify that certificates are up to date.
• Enable webhook notifications from your ACME client for successful renewals.

Industry Reaction and Expert Opinions

Security analysts see the 64‑day default as a pragmatic step. A recent article on SecurityWeek notes that the change gives the community time to adapt before the more aggressive 45‑day plan. Some experts argue that the shorter interval could increase load on Let’s Encrypt’s issuance infrastructure, but the organization has already scaled its backend to handle billions of certificates per year.

Preparing for the Upcoming 45 Day Shift

Let’s Encrypt has indicated that a 45‑day default may be introduced after a period of observation and feedback. To future‑proof your environment, consider the following actions:

1. Adopt ACME clients that support dynamic lifetime parameters.
2. Implement a rolling renewal strategy where certificates are renewed well before they reach half of their lifetime.
3. Participate in Let’s Encrypt community forums to stay informed about timeline adjustments.

By treating the 64‑day default as a rehearsal, organizations can smooth the transition to an even tighter renewal cadence without service interruptions.

Conclusion

The shift to a 64‑day default certificate validity marks a deliberate move by Let’s Encrypt toward more frequent renewals and stronger security postures. While the change requires attention to automation and monitoring, it also offers an opportunity for operators to refine their certificate management practices ahead of the anticipated 45‑day model.