Let's Encrypt Moves to 64-Day Certificates: Check Your Cron Jobs

From 10 February 2027, every certificate Let's Encrypt issues or renews will be valid for 64 days instead of 90. If your renewals are fully automated and your ACME client supports ARI (ACME Renewal Info), you probably have nothing to do. If a script renews certificates when they reach 60 or 80 days old, it needs fixing before then.

Existing certificates are not revoked, and the last 90-day certificate expires on 11 May 2027. Staging has issued 64-day certificates since 14 October, so you can test now. This is the first of several cuts: the default drops to 45 days in 2028, and the authorisation reuse period is also being cut from 30 days to 10, then to seven hours in 2028.

What I would do this week:

• Grep cron jobs, wrapper scripts and runbooks for hard-coded 83, 80 or 60. Let's Encrypt suggests renewing at about two-thirds of the lifetime instead.
• Point one non-critical service at staging and watch a full renewal and reload.
• Alert on failed renewals as well as on expiry.

At two-thirds of 64 days, a certificate renewed by hand needs attention roughly every six weeks, and one missed reminder takes a service down. If you still have a certificate graveyard, clear it before February. Understanding Let's Encrypt covers how ACME and the trust model fit together, and the Cron Expression Explainer will translate a cryptic cron line.