# Let's Encrypt Timeline: 45-Day Certs, OCSP End, Gen Y Roots > Let's Encrypt changes by date: OCSP shut down (Aug 2025), expiry emails ended, six-day and IP certificates, 64-day (2027) and 45-day (2028) certificates. Source: https://ssl.sh/timeline/lets-encrypt/ Last updated: 2026-11-10 Let's Encrypt is moving its default certificates from 90 to 64 days on February 10, 2027 and to 45 days on February 16, 2028. It has already shut down OCSP, stopped expiry reminder emails, dropped the clientAuth EKU and moved to its Generation Y roots. Status as of November 10, 2026 ## Key points - Let's Encrypt's default classic profile will issue 64-day certificates from February 10, 2027 and 45-day certificates from February 16, 2028, with authorization reuse cut to 10 days and then 7 hours. - The opt-in tlsserver profile has issued 45-day certificates since May 13, 2026; six-day and IP-address certificates have been generally available through the shortlived profile since January 15, 2026. - Let's Encrypt shut down its OCSP responders on August 6, 2025 and publishes revocation information only through CRLs. - Let's Encrypt stopped sending expiration reminder emails on June 4, 2025, so certificate monitoring has to come from elsewhere. - The classic profile stopped including the TLS client authentication EKU on February 11, 2026, and the temporary tlsclient profile ended on July 8, 2026. ## Timeline ### September 14, 2015 — First Let's Encrypt certificate (In effect) Let's Encrypt, run by the nonprofit ISRG, announced its first certificate. Who is affected: The start of free, automated certificates for everyone. Source: [Let's Encrypt: Our First Certificate Is Now Live](https://letsencrypt.org/2015/09/14/our-first-cert/) ### December 3, 2015 — Public beta opens (In effect) Anyone could request free 90-day DV certificates through the [ACME](https://ssl.sh/glossary/acme/) protocol. Who is affected: Website operators looking for free certificates. Source: [Let's Encrypt: Entering Public Beta](https://letsencrypt.org/2015/12/03/entering-public-beta) ### April 12, 2016 — Let's Encrypt leaves beta (In effect) Let's Encrypt declared the service production-ready. Who is affected: Hosting providers and panels that began integrating Let's Encrypt by default. Source: [Let's Encrypt: Leaving Beta, New Sponsors](https://letsencrypt.org/2016/04/12/leaving-beta-new-sponsors/) ### March 13, 2018 — ACMEv2 and wildcard certificates (In effect) The ACMEv2 endpoint went live with support for [wildcard certificates](https://ssl.sh/glossary/wildcard-certificate/), which require [DNS-01](https://ssl.sh/glossary/dns-01/) validation. Who is affected: Sites with many subdomains. Source: [Let's Encrypt Community: ACME v2 and Wildcard Certificate Support is Live](https://community.letsencrypt.org/t/acme-v2-and-wildcard-certificate-support-is-live/55579) ### June 1, 2021 — ACMEv1 turned off (In effect) The legacy ACMEv1 API was shut down completely; clients had to use the RFC 8555 (ACMEv2) endpoint. Who is affected: Old ACME clients and scripts that were never upgraded. Source: [Let's Encrypt Community: End of Life Plan for ACMEv1](https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430) ### September 30, 2021 — DST Root CA X3 expires (In effect) The IdenTrust root that cross-signed Let's Encrypt's early chain expired. Clients that did not trust ISRG Root X1 and did not ignore the expired root (for example old OpenSSL 1.0.x) started failing. Who is affected: Old operating systems, embedded devices and outdated OpenSSL builds. Source: [Let's Encrypt: DST Root CA X3 Expiration (September 2021)](https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/) ### February 8, 2024 — Default chain drops the cross-sign (In effect) The default certificate chain stopped including the ISRG Root X1 cross-sign, giving a shorter chain that ends at the self-signed ISRG Root X1. Who is affected: Very old Android devices (before 7.1.1) that relied on the cross-sign. Source: [Let's Encrypt: Shortening the Let's Encrypt Chain of Trust](https://letsencrypt.org/2023/07/10/cross-sign-expiration/) ### June 6, 2024 — Alternate long chain removed (In effect) The optional long chain through the cross-signed ISRG Root X1 was no longer offered at all. Who is affected: Clients that had explicitly selected the alternate chain. Source: [Let's Encrypt: Changes to Issuance Chains](https://letsencrypt.org/2024/04/12/changes-to-issuance-chains/) ### September 30, 2024 — ISRG Root X1 cross-sign expires (In effect) The cross-signed ISRG Root X1 certificate issued by IdenTrust expired. Who is affected: Anyone still serving the old long chain. Source: [Let's Encrypt: Shortening the Let's Encrypt Chain of Trust](https://letsencrypt.org/2023/07/10/cross-sign-expiration/) ### December 5, 2024 — End of OCSP announced (In effect) Let's Encrypt announced it would stop supporting [OCSP](https://ssl.sh/glossary/ocsp/) and rely on [CRLs](https://ssl.sh/glossary/crl/), citing privacy and operating cost. CA/B Forum Ballot SC-063 had made OCSP optional from March 15, 2024. Who is affected: Clients and servers that depend on OCSP or Must-Staple. Source: [Let's Encrypt: Ending OCSP Support in 2025](https://letsencrypt.org/2024/12/05/ending-ocsp/) ### January 9, 2025 — ACME profiles announced (In effect) Let's Encrypt introduced [ACME profiles](https://ssl.sh/glossary/acme-profile/): classic (the default), tlsserver and, later, shortlived. Clients choose a profile when placing an order. Who is affected: ACME client developers and operators who want different certificate types. Source: [Let's Encrypt: Announcing Certificate Profile Selection](https://letsencrypt.org/2025/01/09/acme-profiles/) ### January 30, 2025 — New Must-Staple requests rejected (In effect) Orders requesting the [OCSP Must-Staple](https://ssl.sh/glossary/must-staple/) extension started failing, unless the account had requested a Must-Staple certificate before. Who is affected: Sites that had enabled OCSP Must-Staple. Source: [Let's Encrypt: Ending OCSP Support in 2025](https://letsencrypt.org/2024/12/05/ending-ocsp/) ### May 7, 2025 — OCSP URLs removed from new certificates (In effect) New certificates no longer contained an OCSP URL (CRL URLs were added beforehand), and all Must-Staple requests were rejected. Who is affected: Software that requires an OCSP URL in the certificate. Source: [Let's Encrypt: Ending OCSP Support in 2025](https://letsencrypt.org/2024/12/05/ending-ocsp/) ### June 4, 2025 — Expiration reminder emails end (In effect) Let's Encrypt stopped sending certificate expiration emails, announced on January 22, 2025. Use your own monitoring, for example [SSL Checker](https://ssl.sh/tools/ssl-checker/) or an expiry monitor. Who is affected: Anyone who relied on those emails to notice failed renewals. Source: [Let's Encrypt: Ending Support for Expiration Notification Emails](https://letsencrypt.org/2025/01/22/ending-expiration-emails/) ### August 6, 2025 — OCSP responders shut down (In effect) Let's Encrypt turned off its OCSP service. Revocation information is available only through CRLs. Who is affected: Clients that still queried Let's Encrypt OCSP endpoints. Source: [Let's Encrypt: Ending OCSP Support in 2025](https://letsencrypt.org/2024/12/05/ending-ocsp/) ### November 24, 2025 — Generation Y roots announced (In effect) Let's Encrypt announced new roots, ISRG Root YR (RSA-4096) and ISRG Root YE (ECDSA P-384), each cross-signed by its predecessor, with six new intermediates. None of them carries the clientAuth EKU. Who is affected: Anyone who pins intermediates or ships a custom trust store. Source: [Let's Encrypt: Generation Y Hierarchy](https://letsencrypt.org/2025/11/24/gen-y-hierarchy) ### December 2, 2025 — 45-day certificate plan announced (In effect) ISRG published the schedule for moving Let's Encrypt from 90-day to 45-day certificates, in line with CA/B Forum Ballot SC-081v3. Who is affected: All Let's Encrypt users. Source: [ISRG: From 90 to 45 days](https://isrg.org/post/from-90-to-45/) ### January 15, 2026 — Six-day and IP-address certificates generally available (In effect) Through the opt-in shortlived profile, Let's Encrypt issues [short-lived](https://ssl.sh/glossary/short-lived-certificate/) certificates valid for 160 hours, including [certificates for IP addresses](https://ssl.sh/glossary/ip-address-certificate/) (IPv4 and IPv6). Who is affected: Highly automated deployments and services reached by IP address. Source: [Let's Encrypt: Six-Day and IP Address Certificates Generally Available](https://letsencrypt.org/2026/01/15/6day-and-ip-general-availability) ### February 11, 2026 — Default certificates lose the clientAuth EKU (In effect) Certificates from the classic profile no longer include the TLS client authentication [extended key usage](https://ssl.sh/glossary/extended-key-usage/). A temporary tlsclient profile kept it for existing users. Who is affected: Systems that used Let's Encrypt certificates as client certificates, such as some [mTLS](term:mtls) and server-to-server setups. Source: [Let's Encrypt: Ending TLS Client Authentication Certificate Support in 2026](https://letsencrypt.org/2025/05/14/ending-tls-client-authentication/) ### May 13, 2026 — tlsserver profile issues 45-day certificates (In effect) The opt-in tlsserver profile switched to 45-day certificates, giving early adopters the future default lifetime. Who is affected: ACME clients that request the tlsserver profile. Source: [ISRG: From 90 to 45 days](https://isrg.org/post/from-90-to-45/) ### June 3, 2026 — All server-certificate profiles issue from Gen Y or ISRG Root X2 (In effect) By this date every Let's Encrypt profile that issues server certificates had moved to the Generation Y hierarchy or ISRG Root X2. Who is affected: Clients with custom trust stores that need the new roots. Source: [Let's Encrypt: Generation Y Hierarchy](https://letsencrypt.org/2025/11/24/gen-y-hierarchy); [Let's Encrypt Community: Upcoming profile changes in May 2026](https://community.letsencrypt.org/t/upcoming-let-s-encrypt-profile-changes-on-may-13-20th-and-27th/247049) ### July 8, 2026 — tlsclient profile discontinued (In effect) The temporary tlsclient profile, the last way to get a Let's Encrypt certificate with the clientAuth EKU, is no longer available. Who is affected: Remaining users of Let's Encrypt certificates for client authentication; move to a [private CA](term:private-ca). Source: [Let's Encrypt: Profiles](https://letsencrypt.org/docs/profiles/); [Let's Encrypt: Ending TLS Client Authentication Certificate Support in 2026](https://letsencrypt.org/2025/05/14/ending-tls-client-authentication/) ### February 10, 2027 — Default certificates: 64 days, 10-day authorization reuse (Upcoming) The classic profile is scheduled to issue 64-day certificates and to reuse domain authorizations for only 10 days. Who is affected: Most Let's Encrypt users. Source: [ISRG: From 90 to 45 days](https://isrg.org/post/from-90-to-45/) ### February 16, 2028 — Default certificates: 45 days, 7-hour authorization reuse (Upcoming) The classic profile is scheduled to issue 45-day certificates and to reuse authorizations for only 7 hours, so each renewal effectively validates the domain again. Renew with [ARI](https://ssl.sh/glossary/ari/). Who is affected: All Let's Encrypt users on the default profile. Source: [ISRG: From 90 to 45 days](https://isrg.org/post/from-90-to-45/) ## FAQ ### Do I need to do anything before Let's Encrypt moves to 64-day certificates? If your ACME client renews automatically and does not assume a fixed 90-day lifetime, nothing breaks. Check that it renews based on the certificate's actual lifetime or on [ARI](https://ssl.sh/glossary/ari/) (RFC 9773) rather than a hard-coded 60-day timer, and that validation still works without manual steps. ### Why did my Let's Encrypt certificate stop working for client authentication? Certificates from the classic profile no longer include the clientAuth extended key usage since February 11, 2026, and the tlsclient profile that kept it was discontinued on July 8, 2026. Use a [private CA](https://ssl.sh/glossary/private-ca/) for client certificates and mutual TLS. ### Does Let's Encrypt still support OCSP or OCSP Must-Staple? No. OCSP URLs were removed from new certificates on May 7, 2025, Must-Staple requests are rejected, and the OCSP responders were shut down on August 6, 2025. Revocation status is published in CRLs. ### Which root does Let's Encrypt use now? As of June 3, 2026, all server-certificate profiles issue from the Generation Y hierarchy (ISRG Root YR for RSA, ISRG Root YE for ECDSA, each cross-signed by its predecessor) or from ISRG Root X2. Serve the chain your ACME client receives and do not pin intermediates.