Open Certificate Authority (CA) Let’s Encrypt is taking the first step towards reducing the validity period of the certificates it issues.
Beginning February 10, 2027, it will issue certificates with 64-day lifetimes by default, in preparation for 45-day lifetimes planned for 2028.
In line with the CA/Browser Forum Baseline Requirements, the shorter certificate validity period is expected to improve security on the web by making revocation more efficient and limiting the scope of compromise.
All publicly trusted CAs will make similar changes, Let’s Encrypt noted in a December 2025 blog, when it revealed the planned timeline for switching to 45-day certificates.
Last week, the CA announced that, after February 10, 2027, all newly issued or renewed certificates will have a 64-day validity period, with the last 90-day certificate expected to expire on May 11, 2027.
This week, Let’s Encrypt will start issuing 64-day certificates in its staging environment for testing purposes, and recommends that all customers perform similar tests before the change enters production.
“If your renewals are automated and your client supports ACME Renewal Info (ARI), you should be all set since ARI allows Let’s Encrypt to tell your client when to renew (you can review your ACME client’s documentation to determine if ARI is implemented),” Let’s Encrypt notes.