Let's Encrypt 64-Day Certificates Arriving in Feb 2027

Let's Encrypt is shifting its certificate validity period down from 90 days to 64 days, with the change scheduled to take effect in February 2027. While an initial glance might suggest that 64 days is still plenty of time, compressing this lifecycle directly breaks many assumptions built into existing automated renewal scripts.

Under the standard 90-day certificate model, Certbot's default 30-day renewal window triggers renewals around day 60, providing a comfortable 30-day buffer. With 64-day certificates, keeping that same 30-day window forces renewals to happen on day 34, leaving a mere 4-day overlap if something goes wrong during the process.

Most administrators will likely adjust their window to 20 days, pushing renewals to day 44. While this is an improvement, it still creates a tighter margin than before. A common check implemented in various environments uses hardcoded command lines to verify expiration thresholds, which fails to scale cleanly as certificate durations shrink.

Stock photo for illustration only, not from the actual event

To build a robust and future-proof pipeline, developers should stop hardcoding days and instead compute the renewal window as a percentage of the total certificate lifetime. By calculating the absolute lifetime in seconds and setting a threshold to renew when 30 percent of the life remains, the logic scales seamlessly whether you manage 90-day, 64-day, or potential future 45-day certificates.