Let’s Encrypt has started issuing 64-day TLS certificates in its staging environment for the default classic profile, according to an API announcement on October 14, 2026.
TLS certificates are often still called SSL certificates, especially in hosting dashboards. The current timeline has four dates that matter for most Let’s Encrypt users:
October 14, 2026: Let’s Encrypt staging begins issuing 64-day certificates for the classic profile.
February 10, 2027: Let’s Encrypt production certificates issued or renewed on the classic profile move to 64-day validity by default, unless a shorter profile is selected.
May 11, 2027: Let’s Encrypt expects the last 90-day certificate to expire.
February 16, 2028: The classic profile is scheduled to move again, this time to 45-day certificates with a seven-hour authorization reuse period.
The February 2027 change is the first default-lifetime cut for most Let’s Encrypt users. Let’s Encrypt said it will not revoke otherwise valid certificates as part of this lifetime change. It also said the change will not affect ACME endpoints or issuance chains.
The operational risk is hidden renewal logic
The main risk is not the shorter certificate by itself. It is renewal logic that silently assumes 90-day certificates will keep existing forever.
Modern ACME automation should handle shorter lifetimes if it runs often enough, renews at an appropriate time, deploys the new certificate, and reloads the service that uses it. Let’s Encrypt points administrators toward ACME Renewal Information, or ARI, which lets the certificate authority tell supported ACME clients when renewal should happen.
The weaker point is old renewal timing. Let’s Encrypt specifically called out hard-coded numbers such as 83, 80, and 60 in cron jobs, wrapper scripts, and runbooks. A 60-day renewal interval becomes especially risky as Let’s Encrypt moves toward 45-day certificates in 2028.
Manual renewal is another weak point. A quarterly reminder was already thin under a 90-day certificate. It becomes a much tighter process at 64 days and stops being realistic at 45 days for most public websites.
Managed hosting may reduce the work, but it does not erase the issue
For many small-business and WordPress sites, certificate automation may be handled by a host, control panel, CDN, or managed WordPress platform. Those environments may require no action from the site owner, but the change still depends on the provider’s renewal and deployment automation.
Self-hosted WordPress installs, VPS deployments, custom NGINX or Apache servers, home labs, and business devices using Let’s Encrypt directly have more to check. The relevant question is not whether the website uses WordPress. It is whether the certificate can renew, install, and reload services without manual steps.
Certificate renewal is also separate from mixed content. A site can have a valid certificate and still load insecure HTTP assets; Tech Help Canada has a separate guide to fixing mixed content warnings in WordPress.
Rate limits are not the main concern
Shorter lifetimes mean more renewal events. Let’s Encrypt said the move from 90-day certificates to 45-day certificates will eventually double daily renewal requests, because renewal shifts from roughly day 60 of a 90-day certificate to roughly day 30 of a 45-day certificate.
Let’s Encrypt said subscribers should not need higher rate limits because of the shorter lifetimes. Renewals coordinated through ACME Renewal Information are exempt from all rate limits, while non-ARI renewals using the same identifiers are exempt from the main new-order and registered-domain limits but can still be subject to some other limits.
New names and changed certificate identifier sets still need normal rate-limit awareness; routine renewal is not the pressure point Let’s Encrypt is flagging.
The wider certificate system is shrinking lifetimes too
Let’s Encrypt’s schedule sits inside a broader Web PKI transition. The CA/Browser Forum’s Ballot SC081v3 set a staged reduction for publicly trusted TLS certificate validity: 200 days beginning March 15, 2026, 100 days beginning March 15, 2027, and 47 days beginning March 15, 2029.
Let’s Encrypt is already below the industry maximum because its production default remains 90 days as of October 2026. Its planned 45-day default in 2028 would put it ahead of the 2029 47-day ceiling.
Why shorter lifetimes are being pushed
Let’s Encrypt and the CA/Browser Forum both frame shorter certificate lifetimes as a security measure. Shorter validity narrows the time that a compromised key or mis-issued certificate remains useful, and it reduces reliance on revocation systems that have long been difficult to make reliable at internet scale.
The tradeoff is operational. Public certificate management is becoming less tolerant of one-off renewals, forgotten appliances, unsupported ACME clients, and undocumented scripts.
What administrators should check before February
The practical work is an audit of certificate automation rather than a website redesign.
Check ACME client support: confirm whether the client supports ARI or otherwise renews on a schedule that adapts to the certificate lifetime.
Search for fixed timing: review cron jobs, wrapper scripts, runbooks, monitoring rules, and deployment notes for 90-day assumptions or hard-coded renewal intervals.
Test deployment hooks: renewal is only useful if the new certificate is installed and the relevant web server, proxy, container, or service reloads correctly.
Review expiry monitoring: alerts should catch failed renewal early enough to leave room for repair, not only warn when a certificate is already close to expiry.
Ask providers about readiness: provider-managed sites should have clarity on when the host, CDN, or control panel will support 64-day and later 45-day Let’s Encrypt renewals.
Testing in staging is now available for the classic profile. Production certificates do not change until February 10, 2027.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
