Let's Encrypt 64-Day Certificates: Test Your Renewals Before February 2027

Let's Encrypt is cutting its default certificate lifetime from 90 to 64 days on February 10, 2027, and said it would start issuing 64-day certificates in its staging environment on October 14, 2026 so you can test first. If your renewals are fully automatic, little changes. If anything renews on a fixed day count, fix it before February.

The announcement came on October 7, 2026. With staging scheduled to switch on October 14, the remaining months of 2026 are the window to find the scripts, cron jobs and runbooks that quietly assume 90 days.

What happened

In a post titled 64-Day Certificate Lifetimes Coming Feb 2027, dated October 7, 2026, Let's Encrypt set out its timeline:

The post states: "We will switch to issuing 64 day certificates in our staging environment on October 14, 2026 to enable testing." It also says: "We will not revoke valid certificates as a part of this process," so certificates you already have stay valid until they expire.

Two other changes come with it:

• Authorization reuse drops from 30 days to 10. Once you prove control of a domain, Let's Encrypt reuses that proof for a period. Shorter reuse means more frequent validation. The post says: "Unless you have specifically designed your ACME client to rely on validation reuse, you will not need to make any changes."
• Rate limits are unchanged. The post says rate limits "will not be impacted by this change."

ACME endpoints and certificate chains are not affected. If you still want shorter certificates, Let's Encrypt's profiles already offer tlsserver (45 days) and shortlived (about six days).

Why it is happening

Let's Encrypt says shorter lifetimes reduce the risk from key compromise and mis-issuance. The wider industry is moving the same way: the maximum lifetime for publicly trusted certificates falls to 100 days for certificates issued from March 15, 2027 and to 47 days from March 15, 2029, as Let's Encrypt's profiles page notes. Our guide to shrinking TLS certificate lifetimes covers that schedule.

Who this affects

• Sites using Let's Encrypt through a host's control panel or a CDN. Usually nothing to do, but worth confirming that renewal is automatic.
• Servers running Certbot, acme.sh or another ACME client. Check how renewal timing is decided.
• Anyone with custom renewal scripts or cron jobs that renew at a fixed number of days, for example 30 days before expiry or every 60 days.
• Appliances and services where a certificate is copied in by hand, such as load balancers, mail servers or VPN gateways that get a copy of a Let's Encrypt certificate from another machine.
• Teams with runbooks that say "renew every 80 days" or similar.

The fixed-interval trap

The most likely failure is a script that works perfectly today. A job that renews "every 80 days" or "at 83 days old" is fine with a 90-day certificate, but with a 64-day certificate the old certificate expires before the script runs.

Let's Encrypt's advice is specific: "Grep for common hardcoded numbers like 83, 80 or 60 in cron jobs, wrapper scripts and runbooks if you're not sure."

The fix is one of two approaches:

1. Use ACME Renewal Info (ARI). If your client supports ARI, Let's Encrypt tells it when to renew. The post says you should then be all set, but check your client's documentation to confirm support.
2. Renew at about two-thirds of the lifetime. For a 64-day certificate that is roughly day 42 or 43, leaving about three weeks to fix a failure.

How to test in staging

Staging is a separate Let's Encrypt environment whose certificates are not trusted by browsers. According to the staging environment documentation:

• The staging ACME directory is https://acme-staging-v02.api.letsencrypt.org/directory.
• Certbot users can add --test-cert or --dry-run to use staging, and Certbot creates a separate staging account automatically.
• Staging has rate limits too, with different values from production.

A dry run tells you whether issuance and renewal work end to end. It does not prove your timing logic, so also read the renewal configuration itself.

Practical checklist

1. List every place you use Let's Encrypt, including subdomains, mail servers, APIs and internal tools with public certificates.
2. Find out who renews each one: your host, your CDN, an ACME client on the server, or a person.
3. Search for hardcoded intervals. Look for 90, 83, 80, 60 and 30 in cron entries, scripts, CI pipelines and documentation.
4. Switch to ARI or two-thirds renewal where you control the client. Our guide to automating SSL certificate renewal covers Certbot, acme.sh and cPanel AutoSSL.
5. Run a staging test with --dry-run or by pointing your client at the staging directory.
6. Automate the reload. A renewed certificate does nothing until your web server, mail server or load balancer reloads it. Script that step and any copying to other machines.
7. Check CAA records if you add a second certificate authority as a backup. Look up your current records with our DNS lookup tool and see our CAA records guide.
8. Monitor expiry from outside. Let's Encrypt stopped sending expiration emails on June 4, 2025, so check what each hostname actually serves with our free SSL checker and set alerts. Our website monitoring guide suggests how often to check.

Make It Flow can help small teams set up certificate monitoring and alerts so renewals only need a person when something fails.

Frequently asked questions

When do Let's Encrypt certificates become 64 days?

From February 10, 2027, every Let's Encrypt certificate issued or renewed gets a 64-day lifetime by default. Let's Encrypt scheduled its staging environment to switch to 64-day certificates on October 14, 2026 for testing. Certificates issued before February 10 keep their 90-day lifetime, and Let's Encrypt expects the last of those to expire around May 11, 2027.

Will my existing Let's Encrypt certificate be revoked?

No. Let's Encrypt says it will not revoke valid certificates as part of this change. Your current certificate stays valid until its normal expiry date, and your next renewal after February 10, 2027 will simply produce a 64-day certificate.

Do I need to do anything if my host handles SSL?

Probably not, but confirm it. Ask your host or check your control panel that certificates renew automatically, then check your live certificate's expiry date with an SSL checker. The risk sits mainly with self-managed servers, custom scripts and devices where certificates are copied in by hand.

What is ACME Renewal Info (ARI)?

ARI is a way for a certificate authority to tell an ACME client when to renew. Instead of you hardcoding "renew at day 60", the client asks Let's Encrypt for a suggested renewal window. Let's Encrypt says clients that support ARI should be ready for the change without further work.

Will 64-day certificates hit Let's Encrypt rate limits?

Let's Encrypt says rate limits will not be impacted by this change. You will renew more often over a year, so it is still worth checking that your setup does not request duplicate certificates or retry failures in a tight loop.

Related reading

• TLS Certificate Lifetimes Are Shrinking to 47 Days: The Schedule: The CA/Browser Forum cut maximum TLS certificate lifetimes to 200 days in 2026, 100 in 2027 and 47 in 2029. Here is the schedule and how to prepare.
• Automate SSL Certificate Renewal: Certbot, acme.sh and AutoSSL: How to automate SSL/TLS certificate renewal with Certbot, acme.sh or cPanel AutoSSL, test it, reload your server, and monitor expiry from outside.
• 200-Day TLS Certificates: The First Renewal Wave Is Here: The first 200-day TLS certificates issued since March 2026 are now expiring. How websites should automate renewal before the 100-day cap in March 2027.

Sources

• Let's Encrypt: 64-Day Certificate Lifetimes Coming Feb 2027 (October 7, 2026)
• Let's Encrypt: Staging Environment documentation
• Let's Encrypt: Profiles documentation
• Let's Encrypt: Expiration Notification Service Has Ended (June 26, 2025)