Let’s Encrypt has announced that, starting in February 2027, all newly issued certificates from the certificate authority will carry a default validity period of 64 days. The change marks an intermediate step on the path toward a broader industry shift to 45-day certificate lifespans.

Let’s Encrypt, the free, automated certificate authority widely used to secure websites and services with TLS, has long championed shorter certificate lifetimes as a security best practice. Shorter validity windows reduce the window of exposure if a private key is compromised, limit the usefulness of stolen or mis-issued certificates, and force organizations to rely on automated renewal rather than manual, error-prone processes.

Why It Matters

For security teams, the move underscores a continuing industry trend away from long-lived certificates (which once ran for years) toward shorter cycles measured in weeks. Organizations that still manage TLS certificates manually, or that rely on ad hoc renewal reminders, will find that model increasingly unworkable as validity periods shrink.

  • Automation becomes mandatory: Teams relying on the ACME protocol or similar automated issuance and renewal tooling will be best positioned to absorb the shorter cycle without service disruptions.
  • Inventory and visibility matter: Shops that lack a clear inventory of where certificates are deployed, including on internal systems, IoT devices, and third-party integrations, face a higher risk of outages as renewal windows tighten.
  • Plan ahead of 2027: With the 64-day default arriving before the eventual 45-day standard, administrators have a runway to test and validate automated renewal pipelines now rather than scrambling later.

No specific vulnerabilities or incidents prompted this change. Rather, it reflects Let’s Encrypt’s ongoing strategy, shared broadly across the certificate authority ecosystem, of incrementally reducing certificate lifetimes to strengthen the overall security posture of the web’s TLS infrastructure.

Organizations that depend on Let’s Encrypt certificates, directly or through hosting providers and platforms that use the service under the hood, should confirm their renewal automation is robust well before the February 2027 deadline.