Let’s Encrypt Details 64-Day Certificate Rollout

Let’s Encrypt said on October 7, 2026 that its default certificates will move from 90 to 64 days on February 10, 2027. A staging test starts October 14. Website owners should check how their certificates renew before the shorter lifetime reaches production.

What changes, and when

Let’s Encrypt will issue 64-day certificates by default for new orders and renewals starting February 10, 2027, unless a subscriber selects an even shorter available profile. Its staging environment will switch to 64-day certificates on October 14, 2026 so administrators can test ahead of production. Let’s Encrypt expects its last 90-day certificate to expire on May 11, 2027. It says it will not revoke still-valid certificates as part of this transition.

This is an issuer-specific rollout, not a change to every certificate on the web. Our earlier certificate-lifetime overview explains the broader industry timetable; the new Let’s Encrypt update gives website teams concrete dates for this issuer.

Why website owners should check renewal now

Shorter validity means a renewal process has less time to recover from a failure. Let’s Encrypt says automated renewals using an ACME client that supports ACME Renewal Info (ARI) should be ready, because the issuer can tell the client when to renew. If a renewal script instead waits a fixed number of days, its timing may be too late for a 64-day certificate. Let’s Encrypt recommends renewing at about two-thirds of the certificate’s lifetime when ARI is unavailable.

Check which certificate authority issued the certificate your site currently serves, who manages renewal, and whether the new certificate is deployed and the web service reloaded automatically. Set an alert for failed renewals or an approaching expiry, then test the full process in a safe environment. Our HTTPS website checklist covers the visitor-facing result to verify after a renewal.

What this means for NicNames customers

The NicNames SSL certificates page lists a free Let’s Encrypt-backed option alongside certificates from another issuer. The announced 64-day default concerns Let’s Encrypt certificates; it does not by itself describe the validity or renewal workflow of the other options. If your site uses the free option, confirm with the system or provider that actually deploys its certificate how renewal and monitoring work. Do not assume that buying or holding a domain automatically renews the HTTPS certificate installed on your website.

Let’s Encrypt also plans a 10-day authorization reuse period from February 2027. Most site owners will not need to change anything specifically for that setting, but custom ACME workflows that reuse prior domain validation should be reviewed against the issuer’s current guidance.