Let's Encrypt to Cut Default TLS Certificate Lifetime to 64 Days in February 2027
Let's Encrypt will shorten its default TLS certificate validity from 90 days to 64 days starting Feb. 10, 2027, with a further cut to 45 days planned for 2028 and a shorter domain-validation reuse window.
Certificates issued or renewed on or after that date will carry the 64-day lifespan unless the subscriber explicitly selects one of the shorter options already available, which are 45 days and six days. Certificates already issued keep their existing expiration dates, and Let's Encrypt expects the last 90-day certificate to expire on May 11, 2027. The organization also confirmed that no valid certificates will be revoked during the transition.
To give administrators time to prepare, Let's Encrypt will begin issuing 64-day certificates in its staging environment on Oct. 14, 2026, allowing renewal setups to be tested before the change takes effect in production.
The 64-day limit is an intermediate step rather than the final target. Let's Encrypt plans to reduce the default certificate lifetime again, to 45 days, in 2028.
A separate change concerns domain validation. Let's Encrypt will cut the period during which a previously completed domain authorization can be reused from 30 days to 10 days, and in 2028 that period will shrink further to seven hours.
According to the Linuxiac report, administrators who use cron jobs or scripts with hardcoded renewal intervals should review their configurations ahead of the February 2027 switch.