Let's Encrypt announced on October 7, 2026 that from February 10, 2027, all subscribers will get 64-day certificates by default, unless they opt into an even shorter lifetime of 45 or 6 days. Every certificate issued or renewed on or after that date will be valid for 64 days, and Let's Encrypt expects the last 90-day certificate to expire on May 11, 2027. Existing certificates will not be revoked as part of the change.

The Timeline

  • October 14, 2026: the staging environment starts issuing 64-day certificates; Let's Encrypt recommends testing there first.
  • February 10, 2027: the default classic profile moves to 64-day certificates, and the period for reusing a completed domain validation drops from 30 days to 10 days.
  • February 16, 2028: the classic profile moves again, to 45-day certificates with a 7-hour validation reuse period.

This is an industry-wide change required by the CA/Browser Forum Baseline Requirements, not a Let's Encrypt-only decision. In our article on 6-day certificates we covered opting into shorter certificates; this change affects everyone on the default settings.

Who Needs to Act

  • Clients that support ARI: in Let's Encrypt's words, you "should be all set". ARI (ACME Renewal Information) lets the CA tell your client when to renew; check your client's documentation to see whether it implements it.
  • Hard-coded renewal timing, such as "renew X days before expiry" or a fixed cron interval: Let's Encrypt recommends renewing at roughly ⅔ of the certificate's lifetime instead, and offers a way to find the problem — grep cron jobs, wrapper scripts and runbooks for common hard-coded numbers such as 83, 80 or 60.
  • Relying on validation reuse: unless your client was specifically designed around reusing validations, nothing needs to change.
  • Rate limits are unchanged, and so are the ACME endpoints and issuance chains.

The shorter the certificate, the sooner a failed renewal bites. Let's Encrypt also suggests using the moment to automate reloads and deployment and to add alerting for renewal failures. For the Nginx side, see configuring a Let's Encrypt SSL certificate; if you issue wildcard certificates with DNS validation (dns-01), the DNS side is covered in pointing a domain to your VPS.

A New Option Coming: Cloudflare Plans to Become a Public CA

On September 29, Cloudflare announced its intent to become a public certificate authority. It has applied to the Chrome, Apple, Microsoft and Mozilla root programs and signed an agreement to acquire a GlobalSign root that has been broadly trusted since 2012. It is explicit that it is not issuing certificates yet. Two of the rules it has published tie in with this change: issuance is ACME-first, so moving from another free CA means changing a directory URL, and it will only issue to clients that support ARI. Whichever CA you end up with, handing renewal timing to ARI is the direction of travel. The other safeguard on certificate issuance is the CAA record — see our piece on the ccTLD registry hijacks.