Guide · updated October 2026

Let's Encrypt is moving to 64-day and 45-day certificates

For years, Let's Encrypt certificates lasted 90 days and most setups renewed every 60. That rhythm ends in February 2027. Here's what changes, which renewals will break, and what to change now.

The dates

Date	What changes
13 May 2026	An opt-in 45-day profile (`tlsserver`) became available. Six-day certificates are available too (`shortlived`).
10 Feb 2027	The default profile issues 64-day certificates, and validated domain authorizations can be reused for 10 days instead of 30.
11 May 2027	Roughly when the last 90-day certificates issued before the switch expire.
16 Feb 2028	The default drops to 45-day certificates, with authorizations reusable for 7 hours.
15 Mar 2029	Industry rules cap every publicly trusted certificate at 47 days.

You'll see the shorter lifetime at the first renewal after each date. Nothing needs to be requested; it simply arrives.

What breaks

Renewing every 60 days. A 60-day cron job or scheduled task works with 90-day certificates, leaves four days of margin with 64-day certificates, and fails outright with 45-day ones. One missed run means an expired site.
Certificates copied by hand from the server that renews them to a load balancer, appliance, mail server or another site. That copy has to happen more often, and it's usually the step someone forgets.
Validating once, issuing for weeks. Domain authorizations can be reused for 30 days today, 10 days from February 2027 and 7 hours from 2028. Setups that validate once and issue later will validate far more often, so DNS-01 automation with stale API credentials will surface quickly.

How to fix renewals

Renew by remaining lifetime, not on a fixed interval. Let's Encrypt recommends renewing at about two thirds of the certificate's lifetime. Most modern ACME clients already work this way by default; check yours isn't overridden by a fixed schedule.
Turn on ARI if your client supports it. ACME Renewal Information lets Let's Encrypt tell your client exactly when to renew, including early renewal if a certificate has to be revoked.
Run the renewal check often. Let the ACME client check daily or twice a day; it only renews when needed.
Automate the deploy step too. Reload the web server after renewal, and script the copy to any appliance or load balancer that doesn't run its own ACME client.
Watch what's actually served. A daily check of the live certificate catches the renewals that succeeded on disk but never reached the service.

How to find the hosts at risk

Look at each host's renewal history. Certificate Transparency logs record when every certificate was issued, so the gap between issuances shows the renewal cycle: a steady gap of about 60 days means a fixed schedule that will break in 2027. Hosts with long-lived commercial certificates need the opposite check: they'll need renewing far more often from March 2027, when public certificates are capped at 100 days.

How Radardue fits

Radardue reads every host's renewal history and marks hosts on a fixed ~60-day cycle as a 2027 risk, and long-lived certificates that will need more frequent renewals as worth watching. It checks the served certificate daily and alerts your team before anything lapses. How the readiness check works, or check a site for free.

Sources: Let's Encrypt, Decreasing Certificate Lifetimes to 45 Days, 64-Day Certificate Lifetimes Coming Feb 2027, Profiles and ACME Renewal Information.