Mark February 10, 2027, in your diary. On that day, the free security certificates that protect millions of websites will start expiring almost a third faster — and any business that has not automated its renewals could be in for an unpleasant surprise. Related reading on our site.
What Is Changing
Let’s Encrypt, the nonprofit certificate authority behind a huge share of the web’s HTTPS encryption, announced on October 7 that from February 10, 2027, all newly issued or renewed certificates will carry 64-day lifetimes by default, down from 90 days. Shorter options of 45 or 6 days will also be available. Existing certificates will not be revoked; the last 90-day certificate is expected to expire naturally on May 11, 2027.
This is not a one-off. It is the next step in an industry-wide timetable: 45-day defaults arrive in 2028, and the CA/Browser Forum’s baseline requirements will cap publicly trusted certificates at 47 days from March 2029. Shorter lifetimes shrink the window in which a stolen private key or a mis-issued certificate can be abused — security through expiry.
What Businesses Must Do Now
The good news: if your renewals are fully automated and your ACME client supports Renewal Info (ARI) — the protocol that lets Let’s Encrypt tell your software when to renew — you are probably fine. The risk sits with everyone else. Let’s Encrypt specifically warns operators to grep cron jobs, wrapper scripts and runbooks for hardcoded numbers like 83, 80 or 60 — relics of the 90-day era — and switch to renewing at roughly two-thirds of the certificate lifetime instead.
There is a testing window: 64-day certificates arrive in Let’s Encrypt’s staging environment on October 14, 2026, so teams can validate their setups without risking production outages. Use it. An expired certificate means browser warnings, broken checkouts and an immediate dent in customer trust — the kind of outage that is entirely preventable, as SecurityWeek’s coverage emphasises.
The Bigger Trend: Automation or Bust
Step back and the message is unmistakable: manual certificate management is being regulated out of existence. A decade ago, commercial certificates lasted one to three years and renewals were calendar entries. Let’s Encrypt’s 90-day default forced the ecosystem toward automation; the 64-day and 45-day steps finish the job. The endgame is already written into industry rules: the CA/Browser Forum’s baseline requirements will cap all publicly trusted certificates at 47 days from March 2029.
For IT leaders, this is the moment to treat certificate lifecycle management as infrastructure — monitored, alerted and automatic — rather than as a recurring chore. Audit every system that touches TLS: web servers, APIs, internal tools, IoT devices. The businesses that thrive will be the ones whose security renews itself while they sleep.