Starting February 10, 2027, Let’s Encrypt will reduce the standard lifetime of SSL/TLS certificates to 64 days. The organization plans to further shorten this duration to 45 days by 2028. Testing for the new 64-day cycle begins on October 14, 2026, allowing users to verify their systems before the production rollout.
The initiative aims to encourage broader adoption of automated renewal processes. Let’s Encrypt recommends that administrators audit their existing cron jobs and runbooks to ensure renewals trigger at two-thirds of the certificate's lifespan. This preparation is essential to avoid potential service downtime once the new policy takes effect.
Additionally, the authorization reuse period will decrease from 30 days to 10 days, with a further reduction to seven hours planned by 2028. This change is designed to eliminate the necessity for CAA rechecks. Most operators will remain unaffected unless their ACME clients rely on cached validation data.
