Your SSL Certificates Will Soon Expire Faster

Starting in 2027, Let's Encrypt's free SSL certificates will expire in 64 days, not 90, forcing more frequent automated renewals.

Let's Encrypt, the nonprofit certificate authority that provides free SSL/TLS certificates to over 300 million websites, has announced a significant change to its issuance policy. As reported by Linuxiac, the organization will reduce the default validity period of its certificates from 90 days to 64 days. This change is scheduled to take effect on February 10, 2027, giving developers and system administrators ample time to prepare. Any certificates issued or renewed after this date will automatically have the shorter lifespan, though existing 90-day certificates will remain valid until their original expiration date. This move continues the industry-wide trend toward shorter certificate lifetimes, fundamentally altering the operational rhythm for website management and security.

The primary driver behind this decision is improved security. Shorter certificate lifetimes reduce the potential damage from a compromised private key. If an attacker gains access to a key, a 64-day validity period limits the time they can use it to impersonate a website or decrypt traffic compared to a 90-day period. This change also reinforces Let's Encrypt's core philosophy of automation. The entire service is built around the ACME (Automated Certificate Management Environment) protocol, which is designed to make certificate issuance and renewal a seamless, machine-driven process. By shortening the renewal cycle, Let's Encrypt further discourages manual certificate management, which is error-prone and doesn't scale. The move effectively forces organizations to adopt and maintain robust automation, treating certificates as temporary credentials that are constantly replaced rather than long-term assets that are manually updated.

This policy shift did not occur in a vacuum. It is the latest step in a long-running industry effort, championed by major browser vendors and the CA/Browser Forum, to make the web more secure by shrinking certificate validity. For years, certificates were valid for two or even three years, creating a massive security risk if a key was ever compromised. In 2020, Apple took a decisive step by having its Safari browser reject any new certificates with a validity period longer than 398 days (approximately 13 months), which effectively forced the entire industry to abandon multi-year certificates. Let's Encrypt's initial 90-day lifetime was already considered progressive, and this new reduction to 64 days pushes the standard even further. It signals a future where certificate rotation could happen on a weekly or even daily basis, completely changing the paradigm of web security infrastructure.

For developers, IT teams, and CTOs, the practical takeaway is clear: audit and strengthen your certificate renewal automation now. While the 2027 deadline seems distant, relying on manual processes or brittle scripts is a significant operational risk. A failed renewal in a 64-day cycle leaves a much smaller window for detection and repair before a certificate expires, potentially causing service outages that erode user trust and impact revenue. Teams should use this announcement as a catalyst to review their entire certificate management lifecycle. This includes verifying that renewal scripts are resilient, implementing comprehensive monitoring and alerting for certificate expirations, and testing failure recovery procedures. As Let's Encrypt often sets the pace for the industry, it is wise to prepare for a future where highly frequent, fully automated certificate rotation is not just a best practice, but the default standard for all secure web services.

This change directly impacts the operational cadence for any team relying on Let's Encrypt. It tightens the window for automated renewal failures, making robust, resilient automation and monitoring more critical than ever to prevent certificate-related outages across web services and APIs.

Shorter certificate lifetimes increase the operational burden on IT and DevOps teams, who must ensure their automation is flawless. A failure to adapt could lead to website downtime, loss of customer trust, and potential revenue impact from expired SSL certificates, which browsers flag as insecure.