Let's Encrypt timeline: every change that affects your certificates
Let's Encrypt is moving its default certificates from 90 to 64 days on February 10, 2027 and to 45 days on February 16, 2028. It has already shut down OCSP, stopped expiry reminder emails, dropped the clientAuth EKU and moved to its Generation Y roots.
Timeline
-
In effect
First Let's Encrypt certificate
Let's Encrypt, run by the nonprofit ISRG, announced its first certificate.
Who is affected: The start of free, automated certificates for everyone.
-
In effect
Public beta opens
Anyone could request free 90-day DV certificates through the ACME protocol.
Who is affected: Website operators looking for free certificates.
-
In effect
Let's Encrypt leaves beta
Let's Encrypt declared the service production-ready.
Who is affected: Hosting providers and panels that began integrating Let's Encrypt by default.
-
In effect
ACMEv2 and wildcard certificates
The ACMEv2 endpoint went live with support for wildcard certificates, which require DNS-01 validation.
Who is affected: Sites with many subdomains.
Source: Let's Encrypt Community: ACME v2 and Wildcard Certificate Support is Live
-
In effect
ACMEv1 turned off
The legacy ACMEv1 API was shut down completely; clients had to use the RFC 8555 (ACMEv2) endpoint.
Who is affected: Old ACME clients and scripts that were never upgraded.
Source: Let's Encrypt Community: End of Life Plan for ACMEv1
-
In effect
DST Root CA X3 expires
The IdenTrust root that cross-signed Let's Encrypt's early chain expired. Clients that did not trust ISRG Root X1 and did not ignore the expired root (for example old OpenSSL 1.0.x) started failing.
Who is affected: Old operating systems, embedded devices and outdated OpenSSL builds.
Source: Let's Encrypt: DST Root CA X3 Expiration (September 2021)
-
In effect
Default chain drops the cross-sign
The default certificate chain stopped including the ISRG Root X1 cross-sign, giving a shorter chain that ends at the self-signed ISRG Root X1.
Who is affected: Very old Android devices (before 7.1.1) that relied on the cross-sign.
Source: Let's Encrypt: Shortening the Let's Encrypt Chain of Trust
-
In effect
Alternate long chain removed
The optional long chain through the cross-signed ISRG Root X1 was no longer offered at all.
Who is affected: Clients that had explicitly selected the alternate chain.
-
In effect
ISRG Root X1 cross-sign expires
The cross-signed ISRG Root X1 certificate issued by IdenTrust expired.
Who is affected: Anyone still serving the old long chain.
Source: Let's Encrypt: Shortening the Let's Encrypt Chain of Trust
-
In effect
ACME profiles announced
Let's Encrypt introduced ACME profiles: classic (the default), tlsserver and, later, shortlived. Clients choose a profile when placing an order.
Who is affected: ACME client developers and operators who want different certificate types.
Source: Let's Encrypt: Announcing Certificate Profile Selection
-
In effect
New Must-Staple requests rejected
Orders requesting the OCSP Must-Staple extension started failing, unless the account had requested a Must-Staple certificate before.
Who is affected: Sites that had enabled OCSP Must-Staple.
-
In effect
OCSP URLs removed from new certificates
New certificates no longer contained an OCSP URL (CRL URLs were added beforehand), and all Must-Staple requests were rejected.
Who is affected: Software that requires an OCSP URL in the certificate.
-
In effect
Expiration reminder emails end
Let's Encrypt stopped sending certificate expiration emails, announced on January 22, 2025. Use your own monitoring, for example SSL Checker or an expiry monitor.
Who is affected: Anyone who relied on those emails to notice failed renewals.
Source: Let's Encrypt: Ending Support for Expiration Notification Emails
-
In effect
OCSP responders shut down
Let's Encrypt turned off its OCSP service. Revocation information is available only through CRLs.
Who is affected: Clients that still queried Let's Encrypt OCSP endpoints.
-
In effect
Generation Y roots announced
Let's Encrypt announced new roots, ISRG Root YR (RSA-4096) and ISRG Root YE (ECDSA P-384), each cross-signed by its predecessor, with six new intermediates. None of them carries the clientAuth EKU.
Who is affected: Anyone who pins intermediates or ships a custom trust store.
-
In effect
45-day certificate plan announced
ISRG published the schedule for moving Let's Encrypt from 90-day to 45-day certificates, in line with CA/B Forum Ballot SC-081v3.
Who is affected: All Let's Encrypt users.
Source: ISRG: From 90 to 45 days
-
In effect
Six-day and IP-address certificates generally available
Through the opt-in shortlived profile, Let's Encrypt issues short-lived certificates valid for 160 hours, including certificates for IP addresses (IPv4 and IPv6).
Who is affected: Highly automated deployments and services reached by IP address.
Source: Let's Encrypt: Six-Day and IP Address Certificates Generally Available
-
In effect
Default certificates lose the clientAuth EKU
Certificates from the classic profile no longer include the TLS client authentication extended key usage. A temporary tlsclient profile kept it for existing users.
Who is affected: Systems that used Let's Encrypt certificates as client certificates, such as some [mTLS](term:mtls) and server-to-server setups.
Source: Let's Encrypt: Ending TLS Client Authentication Certificate Support in 2026
-
In effect
tlsserver profile issues 45-day certificates
The opt-in tlsserver profile switched to 45-day certificates, giving early adopters the future default lifetime.
Who is affected: ACME clients that request the tlsserver profile.
Source: ISRG: From 90 to 45 days
-
In effect
All server-certificate profiles issue from Gen Y or ISRG Root X2
By this date every Let's Encrypt profile that issues server certificates had moved to the Generation Y hierarchy or ISRG Root X2.
Who is affected: Clients with custom trust stores that need the new roots.
Source: Let's Encrypt: Generation Y Hierarchy · Let's Encrypt Community: Upcoming profile changes in May 2026
-
In effect
tlsclient profile discontinued
The temporary tlsclient profile, the last way to get a Let's Encrypt certificate with the clientAuth EKU, is no longer available.
Who is affected: Remaining users of Let's Encrypt certificates for client authentication; move to a [private CA](term:private-ca).
Source: Let's Encrypt: Profiles · Let's Encrypt: Ending TLS Client Authentication Certificate Support in 2026
-
Upcoming
Default certificates: 64 days, 10-day authorization reuse
The classic profile is scheduled to issue 64-day certificates and to reuse domain authorizations for only 10 days.
Who is affected: Most Let's Encrypt users.
Source: ISRG: From 90 to 45 days
-
Upcoming
Default certificates: 45 days, 7-hour authorization reuse
The classic profile is scheduled to issue 45-day certificates and to reuse authorizations for only 7 hours, so each renewal effectively validates the domain again. Renew with ARI.
Who is affected: All Let's Encrypt users on the default profile.
Source: ISRG: From 90 to 45 days
FAQ
Do I need to do anything before Let's Encrypt moves to 64-day certificates?
If your ACME client renews automatically and does not assume a fixed 90-day lifetime, nothing breaks. Check that it renews based on the certificate's actual lifetime or on ARI (RFC 9773) rather than a hard-coded 60-day timer, and that validation still works without manual steps.
Why did my Let's Encrypt certificate stop working for client authentication?
Certificates from the classic profile no longer include the clientAuth extended key usage since February 11, 2026, and the tlsclient profile that kept it was discontinued on July 8, 2026. Use a private CA for client certificates and mutual TLS.
Does Let's Encrypt still support OCSP or OCSP Must-Staple?
No. OCSP URLs were removed from new certificates on May 7, 2025, Must-Staple requests are rejected, and the OCSP responders were shut down on August 6, 2025. Revocation status is published in CRLs.
Which root does Let's Encrypt use now?
As of June 3, 2026, all server-certificate profiles issue from the Generation Y hierarchy (ISRG Root YR for RSA, ISRG Root YE for ECDSA, each cross-signed by its predecessor) or from ISRG Root X2. Serve the chain your ACME client receives and do not pin intermediates.
Sources
- Let's Encrypt: Our First Certificate Is Now Live
- Let's Encrypt: Entering Public Beta
- Let's Encrypt: Leaving Beta, New Sponsors
- Let's Encrypt Community: ACME v2 and Wildcard Certificate Support is Live
- Let's Encrypt Community: End of Life Plan for ACMEv1
- Let's Encrypt: DST Root CA X3 Expiration (September 2021)
- Let's Encrypt: Shortening the Let's Encrypt Chain of Trust
- Let's Encrypt: Changes to Issuance Chains
- Let's Encrypt: Ending OCSP Support in 2025
- Let's Encrypt: Announcing Certificate Profile Selection
- Let's Encrypt: Ending Support for Expiration Notification Emails
- Let's Encrypt: Generation Y Hierarchy
- ISRG: From 90 to 45 days
- Let's Encrypt: Six-Day and IP Address Certificates Generally Available
- Let's Encrypt: Ending TLS Client Authentication Certificate Support in 2026
- Let's Encrypt Community: Upcoming profile changes in May 2026
- Let's Encrypt: Profiles