Let's Encrypt's 64-Day Certificates: What You Need to Know Before February 2027

The Clock is Ticking: Shorter SSL Lifetimes Are Here

Let's Encrypt just dropped a significant announcement that every developer, sysadmin, and DevOps engineer needs to pay attention to. Starting February 10, 2027, the beloved certificate authority will issue certificates with a 64-day lifetime by default—down from the familiar 90 days we've grown accustomed to.

But here's the thing—this isn't a surprise. Let's Encrypt has been signaling this direction for a while, and if you've been paying attention to the broader security landscape, shorter certificate lifetimes have been the writing on the wall. This move is all about reducing risk: the shorter a certificate lives, the less time a compromised key or mis-issued certificate can cause damage.

What Exactly Changes on February 10, 2027?

Let's break down the timeline:

• February 10, 2027: All newly issued and renewed certificates will have a 64-day validity period
• May 11, 2027: The last 90-day certificate (issued right before the cutoff) will finally expire
• 2028: Expect another lifetime reduction to 45 days
• 2029: Authorization reuse periods will shrink dramatically to seven hours

The good news? Let's Encrypt will flip the switch in their staging environment on October 14, 2026, giving you a solid window to test before production changes kick in. We'd strongly recommend taking advantage of this.

Is Your Certificate Management Ready?

Here's where things get interesting for our audience. Let's talk about what you need to check:

If You're Using ARI-Compatible Clients

If your automated renewal setup relies on an ACME client that supports ACME Renewal Info (ARI), you might be in decent shape. ARI allows Let's Encrypt to communicate directly with your client about optimal renewal timing. It's essentially a smarter, more dynamic approach to certificate management that doesn't rely on rigid schedules.

But—and this is important—don't just assume you're fine. Double-check your client's documentation to confirm ARI is actually implemented and functioning. Assumptions are where outages are born.

If You Have Hardcoded Renewal Dates

This is where many of us get caught out. If your renewal logic looks something like "renew 30 days before expiration" or "renew every 90 days," you need to update your approach.

Let's Encrypt recommends renewing at approximately two-thirds of the certificate's lifetime. For 64-day certificates, that's roughly 42-43 days. But here's a pro tip: the math gets easier if you just set your renewals to trigger around 80 days for 90-day certs today—then you won't need to scramble when the switch happens.

Grep through your cron jobs, wrapper scripts, and runbooks for numbers like 83, 80, 60, or 30. Those are telltale signs of hardcoded renewal logic that needs attention.

Authorization Reuse: The Sneaky Change You Might Miss

There's another change buried in the announcement that deserves attention: the authorization reuse period is dropping from 30 days to just 10 days.

For most users, this won't require any changes. Authorization reuse is an optimization that lets your ACME client skip revalidating domain control if you've already done it recently. Unless you've specifically built your infrastructure around relying on this behavior, you can probably ignore this one.

However, Let's Encrypt is making this change to eliminate the need for "CAA rechecking"—a process where validation has to be repeated if the original validation data is older than 7 hours. Starting in 2029, maximum validation reuse periods will shrink to just seven hours, so this is laying the groundwork.

This Is Your Sign to Level Up Your Certificate Management

Here's our take: this change is actually a gift. Not because shorter lifetimes are convenient (they're not, by definition), but because they force us to stop treating certificate management as a "set it and forget it" task.

If you're still SSHing into servers every 89 days to manually renew certificates, you're playing with fire. Certificates expire at the worst possible times—Friday afternoons, holiday weekends, middle of the night during an incident. Automation eliminates that entire class of problems.

While you're at it, consider adding:

• Alerting for renewal failures: Get notified before a certificate expires, not after
• Automated deployment: Tie certificate renewal directly to your service reload process
• Health checks: Monitor certificate expiration dates across your entire infrastructure

The Bottom Line

Let's Encrypt isn't changing anything about rate limits, ACME endpoints, or issuance chains. This is purely a lifetime adjustment with security benefits that align with the broader industry's push toward shorter certificate validity periods.

The transition should be smooth for anyone already running automated renewal workflows. For the rest of us? Consider this your gentle (or not-so-gentle) push to finally implement proper certificate automation.

The staging environment opens in October 2026. That's your testing ground. Use it.

Questions about SSL, certificate automation, or getting your infrastructure ready for these changes? Our team is happy to help you audit your current setup and ensure you're prepared for the transition.

Stay secure out there. Your users (and your on-call rotation) will thank you.