Lets Encrypt reduces default TLS certificate lifetimes to 64 days in 2027

Lets Encrypt will shorten its default Transport Layer Security certificate lifetime from 90 days to 64 days starting on February 10, 2027. Help Net Security, Linuxiac, BetaNews, and Pasquale Pillitteri all reported that the certificate authority will change its default issuance policy on that date. [1][2][3][4]

Help Net Security reported that the organization expects the final 90-day certificates issued under the old policy to expire on May 11, 2027. The certificate authority will not revoke any valid certificates during this operational shift. [1]

Sarah Gran of the Internet Security Research Group said the shift to shorter lifetimes reduces the risk of key compromise and mis-issuance, according to Help Net Security. System administrators with hardcoded renewal schedules must update their automated processes to avoid service disruption. [1]

Lets Encrypt is a non-profit certificate authority operated by the Internet Security Research Group that provides X.509 certificates for Transport Layer Security encryption at no charge. The service is utilized by more than 700 million websites to enforce HTTPS encryption. [5]