Let’s Encrypt forces faster renewals, pushing sites to automate

Let’s Encrypt is a free certificate authority run by the nonprofit Internet Security Research Group (ISRG). A certificate authority is an organization that vouches for a website’s identity so browsers can set up an encrypted HTTPS connection.

Since it launched in early 2016, Let’s Encrypt has issued certificates that last 90 days. From February 10, 2027, every newly issued or renewed certificate will be valid for 64 days by default. Certificates already issued keep their full 90 days, nothing will be revoked during the switch, and the last 90-day certificates are expected to run out by May 11, 2027.

Subscribers who already chose Let’s Encrypt’s optional shorter certificates, which last 45 days or just 6 days, are not affected. The change also leaves its ACME endpoints, issuance chains and rate limits as they are.

The short answer is damage control. If a site’s private key is stolen, or a certificate is issued by mistake, a shorter lifetime limits how long an attacker can misuse it. ISRG’s Sarah Gran said the shorter period reduces the risk of key compromise and mis-issuance.

This is not just a Let’s Encrypt decision. Under CA/Browser Forum rules, the industry body that sets standards for certificate authorities and browsers, all publicly trusted authorities are moving to shorter lifetimes. Let’s Encrypt laid out its own timeline in December 2025.

History helps here. Before Let’s Encrypt, certificates often lasted one to three years and were renewed by hand. Its 90-day certificates were controversial at first, but they forced site owners to automate renewal and helped HTTPS spread across the web. Shorter lifetimes push that same logic further.

Most sites using modern tools will not notice the switch. If your renewals are automated and your ACME client supports ARI, you should be fine. ACME is the protocol software uses to request and renew certificates automatically. ARI, short for ACME Renewal Information, lets Let’s Encrypt tell your software exactly when to renew instead of the software guessing.

The sites at risk are those with renewal timing baked in. Plenty of setups still renew at a fixed point, such as a set number of days before expiry. A job written for 90-day certificates that renews on day 80, for example, would run after a 64-day certificate had already expired.

Let’s Encrypt suggests searching cron jobs, wrapper scripts and internal runbooks for hardcoded values such as 83, 80 or 60, and changing the logic to renew at about two-thirds of a certificate’s lifetime.

Not sure whether your site even uses Let’s Encrypt? Open it in a browser, click the padlock or site settings icon next to the address, and view the certificate details. The issuer field names the certificate authority, and it will mention Let’s Encrypt or ISRG if they issued it. While you are there, note the expiry date so you know when the next renewal should happen.

If someone else hosts your site, such as a managed WordPress host or a website builder, renewals are almost certainly handled for you. It is still worth a quick check of your host’s documentation or a message to support asking whether their certificate tooling supports ARI.

If you manage your own server, here is a short checklist:

• Find out which ACME client you use and check its documentation for ARI support.
• Run a test renewal against Let’s Encrypt’s staging environment, which has been issuing 64-day certificates since October 14, 2026.
• Remove hardcoded renewal offsets from scripts and scheduled jobs.
• Automate reloading your web server or load balancer after renewal, so new certificates actually go live.
• Set alerts for failed renewals, so a problem shows up days before visitors see a warning.

The 64-day period is a stepping stone. Let’s Encrypt plans to make 45-day certificates the default in 2028.

A second, less visible change runs alongside it. The authorization reuse period, how long Let’s Encrypt remembers that you proved control of a domain, drops from 30 days to 10 days next year and then to just seven hours in 2028. Gran said this keeps Let’s Encrypt in line with a 2029 cut to maximum validation reuse periods. Unless your ACME client was built to depend on reused validations, you will not need to do anything.