Review · Local Post
Let’s Encrypt is continuing a push toward automated security by reducing free SSL/TLS certificate lifetimes from 90 days to 64 days, starting on February 10, 2027. For administrators already implementing modern ACME clients that support ARI (ACME Renewal Information), the change should be seamless. For those still relying on hardcoded renewal schedules or manual processes, it’s a deadline to update before certificates start expiring unexpectedly.
Starting on October 14, 2026, Let’s Encrypt will begin testing the 64-day certificates, and interested users can opt-in to test their setups before production goes live. SSL/TLS web certificates authenticate secure connections to websites. Prior to Let’s Encrypt’s launch in early 2016 , certificates were often issued for as long as 1 to 3 years at a time.
The service launched with 90-day certificates to push renewal automation that didn’t previously exist, in the interest of encouraging websites to only validate the more secure HTTPS connection. This move was a bit of a shakeup to industry norms at the time, but by limiting the certificate lifetime, the certs are less likely to cause chaos if compromised or assigned in error. The move down to 64 days continues this logic, and the lifespans will only continue to get shorter as time goes on, with 45-day defaults planned to follow in 2028.
Just as the initial rollout of Let’s Encrypt aimed to push users toward HTTPS , the shortened certificate windows are aimed at moving folks over to the automated certificate world. The ACME protocol, and, more specifically, ARI (ACME Renewal Information), allows the certificate authority to tell the client when it’s time to renew. Although ARI does this, many deployments are still stuck on scripted update intervals that trigger at fixed offsets like “60 days before expiration.”
Source: Ars Technica
