Let's Encrypt
Let's Encrypt to cut certificate lifetimes from 90 to 45 days
Let's Encrypt certificates will shrink from 90 days to 45 days in stages through February 2028, according to a plan ISRG announced on 2 December 2025. That keeps Let's Encrypt inside the CA/Browser Forum's 47-day ceiling for March 2029. Authorization reuse, the time one domain validation can back new certificates, will drop to 7 hours.
What happened
The plan changes Let's Encrypt's ACME profiles in three steps:
- 2026-05-13: the opt-in tlsserver profile issues 45-day certificates.
- 2027-02-10 (upcoming): the default classic profile moves to 64-day certificates, with authorizations reusable for 10 days.
- 2028-02-16 (upcoming): the classic profile moves to 45-day certificates, with authorizations reusable for only 7 hours.
The first step affects only subscribers who explicitly request the tlsserver profile. The classic profile, which every ACME client receives unless it asks for something else, is not scheduled to change until February 2027. The 45-day figure sits just below the 47-day maximum that Ballot SC-081 sets for 2029, while the 7-hour authorization reuse is far stricter than the 10 days that ballot allows.
Who is affected
Every Let's Encrypt user is affected eventually. Setups that hard-code a 90-day lifetime break first:
- cron jobs or scripts that renew on a fixed calendar, such as every 60 days;
- monitoring that alerts at a fixed number of remaining days, which can fire constantly once a fresh certificate lasts only 45 days;
- workflows that validate a domain once and then issue several certificates over the following days, relying on cached authorizations;
- manual DNS-01 validation, where someone adds a TXT record by hand.
Hosting panels and managed platforms that renew through ACME on their own schedule should follow the change automatically, but confirm how they decide when to renew.
What you should do
Base renewal timing on the certificate's actual lifetime, not on a calendar.
- Let your ACME client decide when to renew. Clients that support ARI, ACME Renewal Information (RFC 9773), let the CA suggest a renewal window, which also helps during mass revocation events.
- Automate DNS-01 through your DNS provider's API if you need wildcard certificates.
- Try the shorter lifetime early by requesting the tlsserver profile on a staging or low-risk host.
- Set alert thresholds relative to the lifetime, for example when less than a third of it remains.
Check the lifetime of what you actually serve:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -startdate -enddate
Confirm renewal works end to end:
sudo certbot renew --dry-run
The 47-day certificates guide and the renewal automation guide cover client set-up; the Let's Encrypt timeline lists every dated change.
FAQ
Will my existing 90-day certificates be shortened?
No. Lifetimes change only for newly issued certificates. Each certificate keeps the expiry date it was issued with, and the default classic profile is not scheduled to change before 2027-02-10.
What does 7-hour authorization reuse mean in practice?
Once a domain is validated, Let's Encrypt will rely on that result for only 7 hours. Almost every renewal will therefore need a fresh HTTP-01, DNS-01 or TLS-ALPN-01 challenge, so validation must be automated as well as issuance.
When does the default Let's Encrypt profile change?
On 2027-02-10, when the default classic profile moves to 64-day certificates with 10-day authorization reuse. On 2028-02-16 it moves to 45-day certificates with 7-hour reuse; until then only the opt-in tlsserver profile issues 45-day certificates.