# Let's Encrypt certificate profiles: tlsserver and shortlived

> Choose a Let's Encrypt profile (classic, 45-day tlsserver, 6-day shortlived) and set it in Certbot, acme.sh, lego, Caddy, Traefik or cert-manager.

Source: https://ssl.sh/guides/lets-encrypt-certificate-profiles/
Last updated: 2026-11-10

You choose a Let's Encrypt profile with one client option, such as `--preferred-profile tlsserver` in Certbot, and then make renewal timing fit that profile's lifetime. `classic` certificates last 90 days, `tlsserver` 45 days and `shortlived` about 6 days.

Profile selection follows the IETF draft on ACME profiles and works with Certbot 4.0+, acme.sh 3.1.2+, lego v5, Caddy 2 (experimental option), Traefik v3, cert-manager 1.18+ and the Nginx ACME module 0.3.0+.

## Prerequisites

Profiles change how short-lived certificates are, so renewal must already be automatic.

- An ACME client at or above the versions listed above.
- A scheduler that runs renewal at least daily; for `shortlived`, at least twice a day is safer.
- Software that does not depend on the certificate's subject Common Name (relevant to `tlsserver` and `shortlived`).

## Step 1: Compare the profiles

`classic` stays the default; `tlsserver` and `shortlived` are opt-in profiles with shorter lifetimes and fewer certificate fields:

| Profile | Lifetime | Names | Common Name | Notes |
|---|---|---|---|---|
| `classic` | 90 days; 64 days from Feb 10, 2027; 45 days from Feb 16, 2028 | up to 100 DNS names | included | default when no profile is requested |
| `tlsserver` | 45 days | up to 25 DNS names | omitted | short authorization reuse (7 hours) |
| `shortlived` | 160 hours | up to 25 DNS or IP names | omitted | no revocation information required |

The former `tlsclient` profile was retired on July 8, 2026, and the `classic` profile stopped including the TLS Client Authentication EKU on February 11, 2026. Use a private CA for client certificates.

## Step 2: Check what the server offers

The ACME directory lists the profiles Let's Encrypt offers in its `profiles` object:

```bash
curl -s https://acme-v02.api.letsencrypt.org/directory | python3 -m json.tool | grep -A6 '"profiles"'
```

The staging directory at `https://acme-staging-v02.api.letsencrypt.org/directory` lists the same profiles; use it to test.

## Step 3: Configure your client

Each client takes the profile name as a single option or setting.

**Certbot 4.0+** (the choice is saved for renewals from 4.1):

```bash
sudo certbot certonly --nginx -d example.com --preferred-profile tlsserver
```

`--required-profile` fails instead of falling back when the server does not offer the profile.

**acme.sh 3.1.2+**:

```bash
acme.sh --issue --server letsencrypt -d example.com --dns dns_cf --cert-profile tlsserver
```

**lego v5**:

```bash
lego run --accept-tos --path /etc/lego --dns cloudflare -d example.com --profile tlsserver
```

**Caddy** (marked experimental):

```caddy
example.com {
    tls {
        issuer acme {
            profile tlsserver
        }
    }
}
```

**Traefik v3** static configuration (also set `certificatesDuration` in hours so renewal timing matches):

```yaml
certificatesResolvers:
  le:
    acme:
      email: admin@example.com
      storage: /letsencrypt/acme.json
      profile: tlsserver
      certificatesDuration: 1080
      httpChallenge:
        entryPoint: web
```

**cert-manager 1.18+** (`spec.acme.profile` on the Issuer or ClusterIssuer):

```yaml
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    profile: tlsserver
```

**Nginx ACME module 0.3.0+**, inside `acme_issuer`:

```nginx
profile tlsserver;
```

## Verify

After the next issuance, a `tlsserver` certificate shows a validity window of 45 days and an empty subject. Confirm the lifetime and the missing CN with the [SSL checker](https://ssl.sh/tools/ssl-checker/), or from any terminal:

```bash
curl ssl.sh/example.com
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -dates
```

The [validity calculator](https://ssl.sh/tools/validity-calculator/) shows when renewal should happen.

## Automatic renewal

With a shorter profile, renewal has to follow the certificate lifetime or ARI instead of a fixed number of days. Certbot 4.0+ renews when one third of the lifetime remains (one half if the lifetime is under 10 days) and Certbot 4.1+ follows ARI; acme.sh 3.1.4+ and lego v5 follow ARI by default; Caddy follows ARI. Remove any hard-coded "renew 30 days before expiry" settings, which would renew a 45-day certificate on almost every run and are impossible for 6-day certificates. With acme.sh, an explicit `--days` overrides ARI since 3.1.5, so leave it unset unless you need it. Add the domain to [ssl.sh monitoring](https://ssl.sh/monitor/) (in development) so a stalled renewal is caught within days.

## Troubleshooting

- **account is not permitted to use certificate profile**: the profile is not open to your account or environment; check the directory listing and Let's Encrypt announcements.
- **unrecognized arguments: --preferred-profile** (or similar): the client predates profile support; upgrade it.
- **Client shows a next renewal date 60 days out for a 6-day certificate**: the client assumes 90-day lifetimes; rely on ARI or set renewal timing explicitly, and verify with monitoring.
- **Legacy software reports an empty subject**: it reads the CN; update it or stay on `classic` until February 2027.
- **Client certificate authentication stopped working**: see [client auth EKU removed](https://ssl.sh/errors/client-auth-eku-removed/).
- **Too many orders while testing**: use the staging directory; see [Let's Encrypt rate limits](https://ssl.sh/errors/lets-encrypt-rate-limit/).