Let's Encrypt Goes to 64 Days on February 10

On October 7, 2026, Let's Encrypt said its certificates will last 64 days instead of 90. Any certificate issued or renewed on or after February 10, 2027 gets the new length by default. Nothing is revoked, so the last 90-day certificates run out around May 11, 2027. In February 2028 it drops again, to 45 days.

Let's Encrypt is going shorter than the rules require. The industry limit is 200 days today, 100 days from March 15, 2027, and 47 days from 2029.

Who it touches

If you renew with certbot or another ACME client on its default settings, probably nothing changes for you. Those clients renew based on how long the certificate actually has left, so a shorter certificate just renews sooner. Clients that support ARI (ACME Renewal Information) go one better: Let's Encrypt tells them when to renew.

The trouble is anything that assumed 90 days:

A cron job that renews every 60 days. With 64-day certificates that leaves 4 days of margin, and one failed run is an outage.
A script or wrapper that counts days from the issue date instead of checking the end date.
A certificate copied by hand onto a load balancer, appliance or mail server, on a calendar reminder set for every 80-something days.
Runbooks and monitoring that treat 90 as the normal lifetime.

Nothing breaks on February 10 itself. It breaks a couple of months later, when the first 64-day certificate runs out before the job or the reminder comes around. Quietly, on whichever server got missed.

What to check

If your client doesn't use ARI, Let's Encrypt suggests renewing at about two thirds of the lifetime. On a 64-day certificate that means renewing about 43 days in, with 21 days left.

Look through your crontabs, renewal scripts and deploy jobs for fixed day counts. 60, 80 and 90 are the usual ones. If you find one, switch to your client's normal renewal check (run it daily and let it decide), or move the number down.

Then check what the server is actually serving, not what the renewal tool says it renewed. With openssl:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates

notBefore and notAfter give you the lifetime and the end date. Or use the certificate lifetime tool, which shows the length, the day it should renew and where it stands against the coming limits.

Let's Encrypt's staging server already issues 64-day certificates, so you can test your setup now.

When auto-renew fails

Auto-renew failing isn't new. Shorter certificates just give it more chances to fail, and less time to notice.

If your monitoring warns at 30 days left, it will go off for every 64-day certificate, because a normal renewal only happens at about 21 days left. Move the warning to after the renewal should have happened, around 16 days left (a quarter of the lifetime). Then a warning always means something actually went wrong.