Guide · updated November 15, 2026

Let’s Encrypt 64-day certificates: what changes on February 10, 2027

On February 10, 2027 (In 87 days), Let’s Encrypt’s default certificates drop from 90 to 64 days, and the time a domain validation can be reused drops from 30 to 10 days.[Let's Encrypt 1 (Let's Encrypt — 64-Day Certificate Lifetimes Coming Feb 2027 (Oct 7, 2026)), 2 (Let's Encrypt — Decreasing Certificate Lifetimes to 45 Days (Dec 2, 2025))] Most automated sites need no change. Sites with renewal timers hard-coded for 90-day certificates do.

What changes, and when

• May 13, 2026: the opt-in tlsserver profile already issues 45-day certificates.[Let's Encrypt 1 (Let's Encrypt — Decreasing Certificate Lifetimes to 45 Days (Dec 2, 2025)), 2 (Let's Encrypt — Profiles)]
• October 14, 2026: the staging (test) environment switched to 64-day certificates so you can test.[Let's Encrypt]
• February 10, 2027: the default classic profile issues 64-day certificates with 10-day authorization reuse.[Let's Encrypt 1 (Let's Encrypt — Decreasing Certificate Lifetimes to 45 Days (Dec 2, 2025)), 2 (Let's Encrypt — 64-Day Certificate Lifetimes Coming Feb 2027 (Oct 7, 2026))]
• May 11, 2027: the last 90-day certificate is expected to expire.[Let's Encrypt]
• February 16, 2028: classic moves to 45-day certificates with 7-hour authorization reuse.[Let's Encrypt 1 (Let's Encrypt — Decreasing Certificate Lifetimes to 45 Days (Dec 2, 2025)), 2 (Let's Encrypt — 64-Day Certificate Lifetimes Coming Feb 2027 (Oct 7, 2026))]

The dates apply to newly issued certificates: you get the shorter lifetime at your first renewal after each date.[Let's Encrypt]

Who needs to act

Let’s Encrypt says most users who renew automatically won’t need to change anything, but should check that their automation copes with shorter certificates.[Let's Encrypt] The risk is a renewal schedule based on a fixed number of days rather than the certificate’s actual lifetime. Let’s Encrypt suggests searching cron jobs, wrapper scripts and runbooks for hard-coded numbers like 83, 80 or 60.[Let's Encrypt] It also warns that renewing at a hard-coded 60-day interval won’t be enough once certificates last 45 days, and that manual renewal is not recommended.[Let's Encrypt]

How common clients behave (from their own docs)

• Certbot: since 4.0.0 it renews when less than a third of the lifetime remains (it was a fixed 30 days before), and since 4.1.0 it checks ARI.[EFF Certbot 1 (Certbot documentation — User Guide (renewing certificates)), 2 (Certbot — CHANGELOG)] Certbot guide
• Caddy: renews with a third of the lifetime left by default and is ARI-aware.[Caddy] Caddy guide
• Apache mod_md: renew window defaults to 33% and ARI is on by default.[Apache Software Foundation]
• Traefik: its defaults assume 90-day certificates renewed 30 days before expiry. Check your settings.[Traefik Labs] Traefik guide
• win-acme (IIS): renews 55 days after issue by default, with ARI on and a 7-day safety net.[win-acme] IIS guide

A quick check

1. Find out which ACME client renews your certificate and which version it is.
2. Check that it renews based on the certificate’s remaining lifetime or ARI, not on a fixed number of days.
3. If you can, test against Let’s Encrypt staging, which already issues 64-day certificates.[Let's Encrypt]
4. Add monitoring so you hear about a failed renewal before visitors do. See expiry reminders.
5. Run the checker on your domain to see how early your certificates are being replaced today.