Open Certificate Authority (CA) Let’s Encrypt is taking the first step towards reducing the validity period of the certificates it issues.
Beginning February 10, 2027, it will issue certificates with 64-day lifetimes by default, in preparation for 45-day lifetimes planned for 2028.
In line with the CA/Browser Forum Baseline Requirements, the shorter certificate validity period is expected to improve security on the web by making revocation more efficient and limiting the scope of compromise.
All publicly trusted CAs will make similar changes, Let’s Encrypt noted in a December 2025 blog, when it revealed the planned timeline for switching to 45-day certificates.
Last week, the CA announced that, after February 10, 2027, all newly issued or renewed certificates will have a 64-day validity period, with the last 90-day certificate expected to expire on May 11, 2027.
This week, Let’s Encrypt will start issuing 64-day certificates in its staging environment for testing purposes, and recommends that all customers perform similar tests before the change enters production.
“If your renewals are automated and your client supports ACME Renewal Info (ARI), you should be all set since ARI allows Let’s Encrypt to tell your client when to renew (you can review your ACME client’s documentation to determine if ARI is implemented),” Let’s Encrypt notes.
For certificates with renewals hardcoded to a specific date from expiration, the CA recommends setting the date to approximately two-thirds of the certificate lifetime.
Let’s Encrypt will also reduce the authorization reuse period to 10 days next year, and further reduce it to seven hours in 2028.
“We are making this change to comply with a 2029 reduction in maximum validation reuse periods, and to remove the need for ‘CAA rechecking’, where we have to repeat part of the validation process if the validation data is more than 7 hours old,” it explains.
According to Let’s Encrypt, the change will not affect ACME endpoints, its issuance chains, or rate limits.
Related: Google Domains Impacted by Recent ccTLD Hijacks
Related: DigiCert Revokes Certificates After Support Portal Hack
Related: Google Working Towards Quantum-Safe Chrome HTTPS Certificates
Related: Zero Trust Creator Says Model Holds Firm Against AI-Assisted Attacks
