On January 15, 2026, Let's Encrypt announced that 6-day short-lived certificates and IP address certificates are generally available. These certificates are valid for 160 hours — just over six days — and are requested through the ACME certificate profile mechanism using the profile named shortlived. This is no longer an experiment; it is available to every subscriber.

Why Make Certificates This Short

The point of short-lived certificates is to stop depending on revocation. Traditionally, if a private key leaks you rely on OCSP or CRLs to tell browsers the certificate is dead — and in practice that chain is unreliable. If a certificate only lives six days, the exposure window is small by construction, which is why Let's Encrypt's 6-day certificates do not embed OCSP or CRL URLs at all.

The direction goes further. In December 2025, Let's Encrypt published its plan to shorten default certificate lifetimes from 90 days toward 45. The whole industry is moving toward shorter and more automated — treating certificates as frequently rotated credentials rather than assets you renew once a year.

Three Hard Consequences for Server Operations

  • Manual renewal is finished: 6-day certificates should be renewed every two to three days, and the recommendation is to run your client at least once per day. Any process that depends on someone remembering will eventually fail.
  • Renewal failures must alert: with 90-day certificates a failure leaves weeks of slack. With 6-day certificates you have tens of hours. A silently failing cron job means going offline.
  • Reloads have to keep pace: Nginx or Apache needs to pick up the new certificate after each renewal. Wire the reload in with a --deploy-hook or a systemd timer instead of restarting by hand.

A Practical Approach

  • Not every site needs 6-day certificates: for an ordinary website, the default profile plus working automation is plenty. The real beneficiaries are setups where key exposure risk is high or revocation delay is unacceptable.
  • Fix automation before shortening the cycle: confirm your certbot or acme.sh timer runs, that renewal logs exist, and that failures notify you — then consider switching to the shortlived profile.
  • Let ARI pick the timing: modern clients support ACME Renewal Information, where the CA tells the client when to renew. That is more robust than a fixed day count.
  • IP certificates close an old gap: serving HTTPS on a bare IP with no domain — temporary panels, internal services — finally has a legitimate answer.

How This Ties Back to Hosting

Short lifetimes require reliable scheduled jobs and web server configuration you actually control. On a lot of shared hosting, certificates are managed by the control panel: you can't change renewal frequency and you never see the failure logs. On your own VPS, the systemd timer, the reload hook and the failure alerting are all yours to configure. SharkCloud plans come with root access and dedicated IPs, with Hong Kong, Japan and US nodes for hosting close to your users — so your HTTPS layer stays under your control.