Server software · checked November 15, 2026

Is Traefik ready for 100-day and 47-day certificates?

Renews automatically

Traefik’s own certificates renew automatically, so the shorter lifetimes (100 days from March 15, 2027, 47 days from March 15, 2029) are handled for you.

What renews automatically

By default Traefik manages 90-day certificates and starts renewing them 30 days before expiry. certificatesDuration (default 2160 hours) is "exclusively used to determine renewal dates".[Traefik Labs]

What doesn’t

Traefik’s documentation lists no setup that needs manual renewal.

When it renews

30 days before expiry by default (90-day assumption).[Traefik Labs]

Check Traefik’s defaults assume 90-day certificates

Traefik documents that by default it manages 90-day certificates and starts renewing 30 days before expiry, with certificatesDuration “exclusively used to determine renewal dates”. Its documentation doesn’t say whether it uses ARI. Check your setting against your CA’s lifetime and test with Let’s Encrypt staging, which has issued 64-day certificates since October 14, 2026.[Traefik Labs; Let's Encrypt]

What to do, and by when

February 10, 2027 · In 87 days
Let's Encrypt default certificates drop to 64 days[Let's Encrypt 1 (Let's Encrypt — Decreasing Certificate Lifetimes to 45 Days (Dec 2, 2025)), 2 (Let's Encrypt — 64-Day Certificate Lifetimes Coming Feb 2027 (Oct 7, 2026))]
Review certificatesDuration for your CA's lifetime and check the logs show renewals after your first 64-day certificate.
February 16, 2028 · In 458 days
Let's Encrypt default certificates drop to 45 days[Let's Encrypt 1 (Let's Encrypt — Decreasing Certificate Lifetimes to 45 Days (Dec 2, 2025)), 2 (Let's Encrypt — 64-Day Certificate Lifetimes Coming Feb 2027 (Oct 7, 2026))]
Same review for 45-day certificates.

Steps

Find certificatesDuration in your Traefik ACME resolver config (default 2160 h = 90 days).
Check Traefik's documentation for your version on how certificatesDuration maps to renewal timing, and test with Let's Encrypt staging (64-day certificates since Oct 14, 2026).
Monitor expiry with an external service.

Not published by Traefik

Whether Traefik uses ACME Renewal Information: not documented on the ACME resolver page.

We re-check these every month.

Questions

Does Traefik handle 64-day Let's Encrypt certificates?

Traefik's documentation says its defaults assume 90-day certificates renewed 30 days before expiry. Test your setup against the staging environment.

Sources

Traefik Documentation — ACME certificate resolver (Traefik Labs, accessed November 15, 2026)

Facts on this page last checked November 15, 2026.