Let’s Encrypt to shorten default certificate validity to 64 days in 2027

• 

  Let’s Encrypt will issue certificates valid for 64 days by default from February 10, 2027, down from 90 days.

• 

  The change is a step toward default 45-day certificates planned for 2028.

• 

  The last 90-day certificate is expected to expire on May 11, 2027, and valid certificates will not be revoked during the transition.

• 

  Let’s Encrypt recommends testing the shorter certificates in its staging environment before the production change.

• 

  Automated renewals using a client that supports ACME Renewal Info should not need changes, while fixed-date renewal schedules may need updating.

Who

Let’s Encrypt, the certificate authority run by the nonprofit Internet Security Research Group.

What

It will make 64-day certificates the default, replacing the current 90-day default.

When

Starting February 10, 2027.

Where

In Let’s Encrypt’s certificate issuance service; testing will begin in its staging environment.

Why

Shorter lifetimes are intended to improve web security by reducing the risk of key compromise and mis-issuance.

This story does not have two clearly opposing sides.