Let's Encrypt moves to 64-day certificates by default from 10 February 2027
Let's Encrypt announced that from 10 February 2027, all certificates issued or renewed will default to 64-day validity. The staging environment switches on 14 October 2026 for testing.
Source: Certificados com validade de 64 dias a partir de fevereiro de 2027 (letsencrypt.org). Text prepared with AI from this source.
What happened and what to do
The Let's Encrypt announcement, published on 7 October 2026, states that on 10 February 2027 all subscribers will receive 64-day certificates by default, unless they select a shorter validity (45 or 6 days). Valid certificates will not be revoked, and the last 90-day certificate is expected to expire on 11 May 2027. The staging environment starts issuing 64-day certificates on 14 October 2026. Authorization reuse drops from 30 to 10 days, and to seven hours in 2028, which requires CAA rechecks when validation data is older than seven hours.
For a company, the practical work is to audit every renewal: ACME clients that support ARI may let the authority set renewal timing; fixed-date renewals should be recalculated to roughly two-thirds of the validity; and hardcoded values such as 83, 80 or 60 days in cron jobs, scripts and runbooks must be found and corrected. It is also worth instrumenting renewal failure alerts, automating reload and deployment of certificates, and testing everything in staging before 10 February 2027.
How the consultancy can help
Diagnosis of your certificate inventory and renewal routines, mapping ACME clients, scheduled tasks and scripts that assume 90-day lifetimes. We then implement the fixes, staging tests, renewal failure alerts and automated reload and deployment, on your own infrastructure.
Next step
Send a short description of how your company manages certificates today, including ACME clients and automation tools, and receive a scoped proposal for the migration.
Let's assess your project
I reply with scope and a proposal.