Let’s Encrypt, the not-for-profit organisation that provides free SSL/TLS certificates, is cutting certificate lifetimes from 90 days to 64 days, starting February 10, 2027. This move aims to push administrators towards ACME automation, ensuring certificates are renewed seamlessly when needed.

Administrators using modern ACME clients, such as those supporting ARI (ACME Renewal Information), should experience a smooth transition. However, those still using hardcoded renewal schedules or manual processes are advised to update before February 10, to avoid unexpected certificate expirations.

Starting October 14, 2026, Let’s Encrypt will begin testing the 64-day certificates, and users can opt in to test their setups. This follows the initial launch in 2016, where certificates were issued for up to three years, and the subsequent move to 90-day certificates to encourage automation.

The push towards shorter lifespans is part of a broader strategy to limit the potential damage from certificate compromises or errors. With 45-day default lifespans planned for 2028, the trend is clear: shorter certificates are on the horizon.

Just as the initial rollout of Let’s Encrypt aimed to push users towards HTTPS, the shortened certificate windows are now aimed at moving users to full ACME automation, ensuring that certificates are renewed as needed without human intervention.