Let's Encrypt will reduce the validity period for its free SSL/TLS certificates from 90 days to 64 days, a change taking effect on February 10, 2027. The organization is implementing this shift to further enhance security and limit the window of exposure if a private key is compromised.
The reduction continues a trend that began when the service launched in early 2016. At that time, Let's Encrypt introduced 90-day certificates to force automation in a market where certificates were often issued for one to three years. By shortening validity periods, the service accelerated HTTPS adoption and required administrators to automate their renewal processes.
Starting October 14, 2026, Let's Encrypt will begin testing the 64-day certificates. Users can opt in to this testing phase to verify their infrastructure before the production rollout. Administrators using modern ACME clients that support ARI (ACME Renewal Information) should experience a smooth transition. However, those relying on hardcoded renewal schedules or manual processes must update their systems before the new standard goes live to prevent unexpected certificate expirations.