Data Protection
Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch
Beginning February 2027, all newly issued certificates will have a 64-day validity period by default.
By
|
October 12, 2026 (3:53 AM ET)
- + Flipboard + Reddit [+ Whatsapp](https://web.whatsapp.com/send?text=Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch https://www.securityweek.com/lets-encrypt-cuts-default-certificate-validity-to-64-days-ahead-of-45-day-switch/) [+ Whatsapp](whatsapp://send?text=Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch https://www.securityweek.com/lets-encrypt-cuts-default-certificate-validity-to-64-days-ahead-of-45-day-switch/) + Email
Open Certificate Authority (CA) Let’s Encrypt is taking the first step towards reducing the validity period of the certificates it issues.
Beginning February 10, 2027, it will issue certificates with 64-day lifetimes by default, in preparation for 45-day lifetimes planned for 2028.
In line with the CA/Browser Forum Baseline Requirements, the shorter certificate validity period is expected to improve security on the web by making revocation more efficient and limiting the scope of compromise.
All publicly trusted CAs will make similar changes, Let’s Encrypt noted in a December 2025 blog, when it revealed the planned timeline for switching to 45-day certificates.
Last week, the CA announced that, after February 10, 2027, all newly issued or renewed certificates will have a 64-day validity period, with the last 90-day certificate expected to expire on May 11, 2027.
This week, Let’s Encrypt will start issuing 64-day certificates in its staging environment for testing purposes, and recommends that all customers perform similar tests before the change enters production.
Advertisement. Scroll to continue reading.
“If your renewals are automated and your client supports ACME Renewal Info (ARI), you should be all set since ARI allows Let’s Encrypt to tell your client when to renew (you can review your ACME client’s documentation to determine if ARI is implemented),” Let’s Encrypt notes.
For certificates with renewals hardcoded to a specific date from expiration, the CA recommends setting the date to approximately two-thirds of the certificate lifetime.
Let’s Encrypt will also reduce the authorization reuse period to 10 days next year, and further reduce it to seven hours in 2028.
“We are making this change to comply with a 2029 reduction in maximum validation reuse periods, and to remove the need for ‘CAA rechecking’, where we have to repeat part of the validation process if the validation data is more than 7 hours old,” it explains.
According to Let’s Encrypt, the change will not affect ACME endpoints, its issuance chains, or rate limits.
Related: Google Domains Impacted by Recent ccTLD Hijacks
Related: DigiCert Revokes Certificates After Support Portal Hack
Related: Google Working Towards Quantum-Safe Chrome HTTPS Certificates
Related: Zero Trust Creator Says Model Holds Firm Against AI-Assisted Attacks
Written By
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
More from Ionut Arghire
- Google Domains Impacted by Recent ccTLD Hijacks
- Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
- US Disrupts Chinese State-Sponsored Hacking Tools
- Citrix Urges Immediate Patching of Critical NetScaler Vulnerability
- Cisco Patches a Dozen Critical Vulnerabilities
- SonicWall and Splunk Patch Critical Vulnerabilities
- Rein Security Raises $25 Million to Guard AI Agents at Runtime
- Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme
Latest News
- IonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion
- Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
- Canonical Websites Disrupted in Second DDoS Attack This Year
- Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US
- iRhythm Data Breach Impacts at Least 360,000 People
- Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
- Critical SonicWall Vulnerability Exploited Days After Disclosure
- Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
Trending
Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
Critical SonicWall Vulnerability Exploited Days After Disclosure
Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
iRhythm Data Breach Impacts at Least 360,000 People
Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US
Security Awareness Training Isn’t Dead, but It Needs a Rethink
Canonical Websites Disrupted in Second DDoS Attack This Year
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
## Webinar: AI Is Accelerating Risk. Can Your IT Operations Keep Up?
October 14, 2026
Learn about Frontier Pace Governance: a practical approach to helping IT operations move at AI speed without sacrificing security, accountability, or operational discipline.
## Virtual Event: Zero Trust & Identity Strategies Summit 2026
October 14, 2026
Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction.
People on the Move
Rapid7 has named Rik Ferguson as VP of Security Intelligence.
Cytactic has appointed Tim Brown as CSO.
Scott Simkin has joined Vega as CMO.
Expert Insights
## AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb)
## Four Cyber Threats Harboring Big Plans for the Future
- AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin)
## Begin at the End: How to Enable Agentic Remediation
Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael)
## “We Think the Security Control Is Working” Is No Longer Good Enough
Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar)
## This Key Will Self-Destruct: An Open Standard for Revocable API Keys
Every leaked credential should be dead, or dying, within sixty seconds of being found. Here’s a proposal to make that the default. (Matt Honea)
- + Flipboard + Reddit [+ Whatsapp](https://web.whatsapp.com/send?text=Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch https://www.securityweek.com/lets-encrypt-cuts-default-certificate-validity-to-64-days-ahead-of-45-day-switch/) [+ Whatsapp](whatsapp://send?text=Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch https://www.securityweek.com/lets-encrypt-cuts-default-certificate-validity-to-64-days-ahead-of-45-day-switch/) + Email
Popular Topics
Security Community
- Virtual Cybersecurity Events
- Webcast Library
- CISO Forum
- AI Risk Summit
- ICS Cybersecurity Conference
- Cybersecurity Newsletters
Stay Intouch
About SecurityWeek
News Tips
Got a confidential news tip? We want to hear from you.
Advertising
Reach a large audience of enterprise cybersecurity professionals
Daily Briefing Newsletter
Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.
Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.