senn-techsenn-tech
Infrastructure
Infrastructure2026-10-07· By Franz Senn

Let's Encrypt moves to 64-day certificates on 10 February 2027

On 7 October 2026 Let's Encrypt announced the next step toward shorter certificate lifetimes. On 10 February 2027 all subscribers move to 64-day certificates by default, unless they pick an even shorter lifetime of 45 or 6 days. Any certificate issued or renewed from that date lasts 64 days. Let's Encrypt expects the last 90-day certificate to expire on 11 May 2027. Nothing is revoked.

Let's Encrypt logo
Dates and rules come from the Let's Encrypt blog post of 7 October 2026. The monitoring remarks come from the Alles nur geCloud newsletter. (Quelle: Simple Icons, file letsencrypt.svg (CC0))

The schedule

Timeline of the change14 October 2026staging: 64 days10 February 2027production: 64 days11 May 2027last 90-day certificateexpires202845 days announced as default
Let's Encrypt explicitly recommends testing in staging before the production change. (Quelle: Let's Encrypt, 7 October 2026)

Lifetimes shrink in steps. As far as announced:

Default Let's Encrypt certificate lifetime in daysToday90 · until 9 February 2027From 10 February 202764 · new default202845 · announced default0100
Lifetimes of 45 and 6 days can also be selected. The 2028 figure comes from the announcement's pointer to earlier posts. (Quelle: Let's Encrypt, 7 October 2026)

What shows up in scripts and runbooks

If renewal is automated with a client that supports ACME Renewal Info (ARI), Let's Encrypt says there is nothing to do. ARI lets the CA tell the client when to renew. The client's documentation says whether it implements ARI.

Renewals pinned to a fixed point in time are another matter. Let's Encrypt recommends moving to roughly two thirds of the lifetime. With 64 days that is about 43 days after issuance, leaving about 21 days of validity. As a search aid the post names the numbers 83, 80 and 60, to be grepped for in cron jobs, wrapper scripts and runbooks. We read them as days since issuance, matching 90-day certificates: 83 and 80 are already past expiry with a 64-day lifetime, and 60 leaves four days of slack. The post does not spell this out.

Monitoring thresholds

The Alles nur geCloud newsletter adds what the announcement leaves out: a classic warning threshold at 30 days of remaining validity fires in every cycle with 64-day certificates, before renewal kicks in at roughly 21 days. With 45 days it turns into a permanent state, according to the newsletter. A check that always warns gets ignored, and then a real failure goes unnoticed too. The threshold belongs below the renewal point, around 14 days for example, or on the renewal failure itself.

Let's Encrypt also advises alerting on failed renewals and automating reload and deployment of certificates. Expiry reminder mails have been discontinued since 2025, according to the newsletter, so an alert has to come from your own monitoring.

Validation reuse and rate limits

The authorization reuse period drops from 30 to 10 days, and to seven hours in 2028. Let's Encrypt points to a reduction of the maximum validation reuse period that takes effect in 2029; at the same time "CAA rechecking", where the CA had to repeat part of the validation when the data was more than seven hours old, goes away. Only clients that deliberately depend on reused validations are affected. Rate limits, ACME endpoints and issuance chains stay as they are.

Our edge servers

The company's Caddy edges fetch certificates via ACME. The pair runs active/active without shared storage, and one pattern there may matter for the change: a new certificate is not issued while both boxes are up. It is issued on one of them and copied to the other. Whether the shorter lifetime strains that procedure, we have not checked. The staging switch on 14 October is the place to find out.

The to-do list for everyone: search scripts for fixed day values, reset monitoring thresholds, and check the ACME client for ARI support. All of it can be done in staging before 10 February 2027.

Further reading

Questions?
When does Let's Encrypt start issuing 64-day certificates?+

From 10 February 2027, every certificate issued or renewed gets a 64-day lifetime unless the subscriber picks a shorter one (45 or 6 days). The staging environment switches on 14 October 2026. Let's Encrypt expects the last 90-day certificate to expire on 11 May 2027. Valid certificates are not revoked.

Do I need to change my ACME client?+

If renewals are automated with a client that supports ACME Renewal Info (ARI), Let's Encrypt says you should be fine. ARI lets the CA tell the client when to renew. If your renewal is hard-coded to a number of days from expiry, move it to roughly two thirds of the lifetime.

What changes for validation reuse?+

Let's Encrypt shortens the authorization reuse period from 30 to 10 days, and to seven hours in 2028. Only ACME clients that deliberately rely on reused validations are affected. Everyone else needs no change, according to Let's Encrypt.