Let's Encrypt Is Cutting Certificate Lifetimes From 90 Days to 64
Let's Encrypt is reducing the lifetime of its free SSL/TLS certificates from 90 days to 64, starting February 10, 2027.
The number is the point. When the service was new, 90-day certificates were chosen to force renewal automation that did not previously exist: a lifetime short enough that renewing by hand at scale stopped being practical. Ars Technica notes that shorter validity periods also limit the damage from private key thefts, and that the practice encouraged faster HTTPS adoption across the web.
Sixty-four days is the same logic applied harder. The sooner a certificate expires, the shorter the stretch in which a stolen private key is useful to anyone. It is a small change with a blunt rationale: certificates that live shorter lives cause less trouble when something goes wrong.
AI-generated discussion · Different perspectives
The operational split is fairly clean: administrators already running modern ACME clients that support ARI should barely notice, while anyone leaning on hardcoded renewal schedules has until February to change the plumbing.
The deadline is the whole enforcement mechanism. Ninety-day renewals were meant to make automation unavoidable; at 64 days, a missed renewal shows up sooner, which narrows the window in which a compromised key still works.