Let's Encrypt will reduce the validity period of the free TLS certificates it issues from 90 days to 64 days, effective February 10, 2027, Ars Technica reports. The nonprofit certificate authority will begin letting users test the shorter-lived certificates on October 14, 2026, giving administrators roughly four months to prepare before the change takes effect in production.
The shift is aimed at pushing website operators toward fully automated certificate renewal. Ars Technica reports that administrators who already run modern ACME clients with support for ARI, or ACME Renewal Information, should see the transition pass without disruption. Those who depend on fixed renewal schedules or manual processes face a deadline to update their systems before certificates begin expiring on unexpected dates.
Why it matters
TLS certificates are what authenticate encrypted connections between a browser and a website. When one expires without being replaced, visitors typically hit security warnings or lose access to the site entirely. Because Let's Encrypt issues certificates at no cost and is widely used across the web, a change to its issuance policy ripples across a large share of the internet's infrastructure.
The reduction also narrows the window in which a compromised or mistakenly issued certificate can be abused. Ars Technica notes that shorter lifespans mean such certificates remain valid for less time, limiting the potential damage. That logic has driven the certificate authority's policy since its early days.
A decade of shrinking lifespans
Let's Encrypt launched in early 2016 with 90-day certificates, a notable departure from the norm at the time. Before the service existed, Ars Technica reports, certificates were commonly issued for periods of one to three years. The shorter term was intended to force the creation of renewal automation that largely did not exist before, and to encourage sites to validate the more secure HTTPS connection rather than fall back on unencrypted HTTP.
The move to 64 days continues that trajectory, and it will not be the end of it. According to Ars Technica, 45-day certificates are planned as the default in 2028.
The automation gap
The ACME protocol, which Let's Encrypt uses to issue and manage certificates, includes a mechanism called ARI that lets the certificate authority tell a client when a renewal is due. In practice, Ars Technica reports, many deployments still rely on scripted intervals that fire at fixed offsets, such as 60 days before expiration. Those setups will need attention as lifespans contract.
The certificate authority is publicizing the change now so that administrators can review their scheduled jobs and runbooks and set renewals to trigger at two-thirds of a certificate's lifespan. Ars Technica reports that authorization reuse periods will also shrink, from 30 days to 10 days, and eventually to seven hours by 2028. That change is expected to remove the need for CAA rechecks, and most operators are unlikely to notice it unless their ACME clients depend on cached validation data.
Administrators have until February 10, 2027, to test their renewal automation. Those who do not could face downtime when the deadline arrives.
Watch for Let's Encrypt's opt-in testing period on October 14, 2026, and for the 45-day default expected in 2028.
