64 Day Certificates Arrive in February 2027: What Shorter TLS Lifetimes Mean for Your Business

There is a particular phone call almost every business owner makes eventually. The website looks broken. Visitors get a full page warning telling them the connection is not private. Nobody deployed anything, nobody touched the server, and yet the front door of the business is papered over with a security notice. Usually the explanation is the same unglamorous one. A certificate expired, and the renewal that used to happen quietly did not happen at all.

That call is about to get more common, because the clock on those certificates is getting much shorter. On October 7, 2026, Let's Encrypt announced that its default certificate lifetime will fall from 90 days to 64 days for every certificate issued or renewed on or after February 10, 2027. This is not one authority acting alone. It is a single step in a schedule the certificate industry agreed to over a year ago, and that schedule ends with certificates living 47 days.

1. What the CA/Browser Forum Actually Decided

The schedule comes from the CA/Browser Forum, where certificate authorities and browser makers write the rules publicly trusted certificates must obey. In April 2025 its server certificate working group adopted ballot SC081v3, titled "Introduce Schedule of Reducing Validity and Data Reuse Periods." Clint Wilson of Apple proposed it, with endorsements from Sectigo, Google Chrome, and Mozilla. Among certificate issuers the vote was 25 in favor and none opposed, and all four certificate consumers that cast a vote supported it.

The dates now live in the Baseline Requirements themselves, in the plainest possible language. Since March 15, 2026, the maximum validity period for a subscriber certificate has been 200 days. On March 15, 2027, it drops to 100 days, and on March 15, 2029, to 47 days. The same table shortens something less visible but equally consequential, the period an authority may reuse your domain validation data, meaning the evidence that you control the name printed on the certificate. That window also fell to 200 days in March 2026, falls to 100 days in March 2027, and reaches 10 days in March 2029.

Those two numbers moving in lockstep is the part worth noticing. Shorter certificates alone would be an annoyance you could absorb with a better calendar reminder. Shorter revalidation windows mean the proof of ownership behind each certificate must be re established almost continuously, which is only practical if a machine does it for you.

2. Why Let's Encrypt Is Moving First

Let's Encrypt is the free, automated certificate authority run by the nonprofit Internet Security Research Group, and it tends to set the pace for everyone else. In February 2026 it said publicly that its default lifetime would go from 90 days to 64 and later to 45. The October announcement attached a date to the first move. Its staging environment began issuing 64 day certificates on October 14, 2026, so administrators can test before production changes on February 10, 2027. Certificates already issued will not be revoked, and the last 90 day certificate is expected to expire on May 11, 2027. A 45 day default is planned for 2028, and subscribers can already choose 45 day or six day certificates.

Six day certificates and certificates for IP addresses became generally available on January 15, 2026. The short lived option is selected through an ACME profile named "shortlived" and runs for 160 hours. Alongside the October change, the window for reusing a completed domain authorization shrinks from 30 days to 10 days now, and to seven hours in 2028.

3. The Email That Is Not Coming

A great many businesses have quietly been relying on the expiration warning email as their safety net. That net is gone. In a post published on January 22, 2025, Josh Aas of Let's Encrypt announced that expiration notification emails would end on June 4, 2025, explaining that most subscribers now have reliable automation, that keeping the notices running meant holding millions of subscriber email addresses alongside issuance records, and that it cost the project tens of thousands of dollars annually. Nobody is going to warn you anymore.

4. Where Your Certificates Actually Live

When we audit a client network, the public website is almost never the interesting part. The certificates that cause real pain are the forgotten ones. The firewall's remote access portal. The mail server and the VPN gateway. The recorder fronting a camera system. The network controller dashboard staff reach by hostname. The copier whose web interface nobody has opened since installation day.

NIST made this point years before the current deadlines existed. In Special Publication 1800 16, "Securing Web Transactions: TLS Server Certificate Management," published in June 2020 by the National Cybersecurity Center of Excellence, the authors noted that most organizations hold far more TLS certificates than they realize, that a medium or large enterprise can run into the thousands or tens of thousands, and that responsibility for them usually sits with whichever team owns each server. Volume B opens its discussion of risk with the most mundane failure of all, outages caused by expiration.

5. Automation Is the Entire Answer

The mechanism for automated renewal is neither new nor exotic. It is ACME, the Automatic Certificate Management Environment, standardized by the IETF as RFC 8555. The newer piece is a companion standard that tells your software when to renew rather than leaving it to guess. ACME Renewal Information, published as RFC 9773 in June 2025 and authored by A. Gable of the Internet Security Research Group, lets an authority suggest renewal timing to its clients. Its stated aim is to smooth load spikes on the authority's side and keep client software from guessing wrong about how often to renew.

Let's Encrypt's own advice for the February change is a sound checklist for any business. Find out whether your ACME client implements renewal information, and test in staging first. Confirm that renewal actually reloads the service holding the certificate, because a renewed file no process has picked up protects nothing. Add alerting for failures. If renewal timing is hardcoded rather than negotiated, renew at roughly two thirds of the lifetime.

Let's Encrypt also offered one wonderfully specific instruction, telling administrators to search "cron jobs, scripts, and runbooks for hardcoded values such as 83, 80, or 60." A script renewing on day 80 of a 90 day certificate is comfortably early. Point that same script at a 64 day certificate and it never fires in time, because the certificate has been dead for sixteen days before the script wakes up. Nothing errors. Nothing warns. The site simply stops being trusted one morning.

6. What We Do Before the Deadline

The work starts with an inventory, where NIST begins its own list of recommended practices, alongside ownership, approved authorities, automation, proactive renewal, and continuous monitoring. For every certificate on a client network we want three answers written down. What renews it. What reloads once it has renewed. What tells a human when either of those fails.

Some equipment will not cooperate, which is fine so long as you know which pieces. Appliances that cannot run an ACME client need either a documented manual renewal with a named owner, or a reverse proxy in front of them that handles certificates on their behalf. Internal systems nobody outside the building reaches can often use a private authority with a long lifetime, since these rules govern public certificates. Drawing that line deliberately, rather than during an outage, is most of the value of starting early.

7. The Dates Worth Putting on a Calendar

February 10, 2027 is when Let's Encrypt defaults become 64 days. March 15, 2027 is when the industry maximum falls to 100 days and validation reuse falls with it. May 11, 2027 is when the last 90 day certificate expires, the real deadline for anything still renewing on a quarterly rhythm. In 2028 the Let's Encrypt default becomes 45 days, and March 15, 2029 brings the 47 day maximum for everyone. A few months of unhurried work now replaces a scramble later, and the business that handles this well will never notice these dates passing.

If you are not certain what certificates your network runs, when each expires, or what happens when one fails to renew, we would be glad to find out with you and build the automation that keeps it quiet. Reach us through our contact page or call (781) 506-6008.

Sources

CA/Browser Forum: Ballot SC081v3 Introduce Schedule of Reducing Validity and Data Reuse Periods
CA/Browser Forum: Baseline Requirements for TLS Server Certificates
Let's Encrypt: 64 Day Certificate Lifetimes Coming February 2027
Let's Encrypt: Shorter Certificate Lifetimes and Rate Limits
Let's Encrypt: Six Day and IP Address Certificates Are Generally Available
Let's Encrypt: Ending Support for Expiration Notification Emails
IETF: RFC 8555 Automatic Certificate Management Environment
IETF: RFC 9773 ACME Renewal Information Extension
NIST: Securing Web Transactions TLS Server Certificate Management