Let's Encrypt sets a 64-day default certificate lifetime for February 2027

On 7 October 2026, Sarah Gran posted that on 10 February 2027 Let’s Encrypt will issue 64-day certificates by default, unless a subscriber selects 45 or 6 days. A certificate issued or renewed on or after that date has a 64-day validity period. Let’s Encrypt expects the last 90-day certificate to expire on 11 May 2027, and it will not revoke still-valid certificates for this change. The post is 64-Day Certificate Lifetimes Coming Feb 2027.

The October post does not say classic. “Select” links to the profiles page. “Previously announced” links to the 2 December 2025 schedule. That page says the default classic ACME profile switches on 10 February 2027 to 64-day certificates and a 10-day authorization reuse period, for subscribers who have not opted into tlsserver or shortlived. On 16 February 2028 the classic profile goes to 45-day certificates and a 7-hour reuse period.

On 16 October 2026 the profiles page still calls classic the default, at 90 days of validity and 30 days of authorization reuse. tlsserver is listed at 45 days. shortlived is “6ish days” in the prose and 160 hours in the table. The announcements say 6 days. The live table says 160 hours.

What to change in a renewal job

If the client supports ACME Renewal Info (ARI), Let’s Encrypt says it can take the renewal time from the CA. If a cron job or a runbook hard-codes a day count, the October post says to renew at about two-thirds of the lifetime, and to search for 83, 80, and 60. Two-thirds of 64 days is about 42 days. Set that offset on a self-hosted model host, an agent sandbox that mints a hostname certificate, and a homelab proxy. The October post says ACME endpoints, issuance chains, and rate limits stay as they are.

The October post says the 64-day step prepares for default lifetimes of 45 days in 2028, and it does not name the day. The upcoming-features page, last updated 22 July 2026, and the December 2025 post both name 16 February 2028.

Reuse, and the staging date

The October post also cuts authorization reuse from 30 days to 10 days, then to seven hours in 2028. That paragraph does not date the 10-day cut. The December 2025 post dates it to 10 February 2027, with the 64-day classic lifetime, and dates seven hours to 16 February 2028. The profiles table still shows 30 days on classic and seven hours on tlsserver and shortlived.

Let’s Encrypt gives two reasons: a 2029 cut in the maximum validation-reuse period, and dropping a CAA recheck when validation data is older than 7 hours. A client that was not built around validation reuse should not need a change for this part, the post says.

Staging, the October post said, would issue 64-day certificates from 14 October 2026. The staging documentation, read on 16 October, does not mention 64-day certificates.

Before 10 February 2027, replace a fixed day count with about two-thirds of the lifetime.