Server software · checked November 15, 2026

Is Certbot ready for 100-day and 47-day certificates?

Renews automatically

Certbot’s own certificates renew automatically, so the shorter lifetimes (100 days from March 15, 2027, 47 days from March 15, 2029) are handled for you, with the exceptions below.

What renews automatically

• Since Certbot 4.0.0 (Apr 7, 2025), a certificate is due for renewal when less than 1/3 of its lifetime remains (1/2 for certificates of 10 days or less). Before 4.0.0 it was a fixed 30 days.[EFF Certbot 1 (Certbot documentation — User Guide (renewing certificates)), 2 (Certbot — CHANGELOG)]
• Since Certbot 4.1.0 (Jun 10, 2025), certbot renew checks ACME Renewal Information (ARI) and may renew early. For Let's Encrypt this typically means about 2/3 of the lifetime.[EFF Certbot]

What doesn’t

• Let's Encrypt warns that renewing on a hard-coded interval such as 60 days won't work with 45-day certificates.[Let's Encrypt]

When it renews

When less than 1/3 of the lifetime remains (Certbot ≥ 4.0), or earlier via ARI (≥ 4.1).[EFF Certbot 1 (Certbot documentation — User Guide (renewing certificates)), 2 (Certbot — CHANGELOG)]

What to do, and by when

1. February 10, 2027 · In 87 days
   Let's Encrypt default certificates drop to 64 days[Let's Encrypt 1 (Let's Encrypt — Decreasing Certificate Lifetimes to 45 Days (Dec 2, 2025)), 2 (Let's Encrypt — 64-Day Certificate Lifetimes Coming Feb 2027 (Oct 7, 2026))]
   Check certbot --version is 4.1 or newer and that renewal runs from Certbot's own timer, not a fixed-interval cron job.
2. February 16, 2028 · In 458 days
   Let's Encrypt default certificates drop to 45 days[Let's Encrypt 1 (Let's Encrypt — Decreasing Certificate Lifetimes to 45 Days (Dec 2, 2025)), 2 (Let's Encrypt — 64-Day Certificate Lifetimes Coming Feb 2027 (Oct 7, 2026))]
   Same check. A forced renewal every 60 days would be too slow.

Steps

1. Run certbot --version. Upgrade if it's older than 4.1.
2. Check how renewal runs (systemctl list-timers | grep certbot, or your crontab). It should run certbot renew at least daily, not a forced renewal every N days.
3. Search cron jobs and scripts for hard-coded numbers like 60, 80 or 83 days, as Let's Encrypt suggests.
4. Test with certbot renew --dry-run.