Certificates
Let’s Encrypt default certificates become 64 days
February 10, 2027 · In 117 days
Let's Encrypt · high confidence · Last verified October 15, 2026
What breaks
Certificates issued or renewed on the default classic profile on or after February 10, 2027 are valid for 64 days instead of 90. A renewal job hard-coded to 60, 80, or 83 days before expiry can miss the window. Authorization reuse drops from 30 days to 10 days.
Who is affected
- Anyone renewing Let’s Encrypt certificates on the default classic ACME profile
- Clients that do not follow ACME Renewal Info (ARI) and instead use a fixed day count
- Operators who rely on authorization reuse longer than 10 days
Source notes
The October 7, 2026 post says subscribers move to 64-day certificates by default unless they select a shorter profile (45 or 6 days). Existing certificates are not revoked. Let’s Encrypt expects the last 90-day certificate to expire on May 11, 2027.
Staging started issuing 64-day certificates on October 14, 2026 so clients can be tested before production. ACME endpoints and issuance chains are unchanged. Rate limits are unchanged for renewals.
If the client supports ARI, Let’s Encrypt can tell it when to renew. Otherwise the post says to renew at about two-thirds of the certificate lifetime. The December 2, 2025 post is the earlier schedule that named this February 10, 2027 step.
Sources
Let’s Encrypt: 64-day certificate lifetimes coming February 2027