Let's Encrypt mandates 64-day certificate validity from February 2027

Let's Encrypt will enforce a 64-day maximum validity period for its free SSL/TLS certificates starting in February 2027, according to reports from Ars Technica. This policy shift mandates that all new certificates issued by the certificate authority adhere to the shorter lifespan. The move aims to improve security posture by limiting the window of exposure for compromised credentials.

Root cause

The decision stems from industry trends favoring shorter certificate lifetimes to mitigate risks associated with long-lived credentials. Let's Encrypt, a prominent provider of free SSL/TLS certificates, identified the need to align with evolving security best practices. By reducing the validity window, the authority limits the impact of potential private key compromises or misconfigurations.

Attack path

Shorter certificate lifetimes do not directly prevent attack vectors but reduce the duration an attacker can exploit a stolen or misissued certificate. If a private key is compromised, the window of opportunity for man-in-the-middle attacks or data interception shrinks significantly. This operational change forces more frequent rotation, which inherently limits the blast radius of any single security incident involving TLS termination.

Affected versions

• All future SSL/TLS certificates issued by Let's Encrypt after February 2027.
• Existing certificates will remain valid until their current expiry dates.
• The policy applies universally to all domains using Let's Encrypt services.

Mitigation

• Audit current certificate renewal scripts to ensure they handle 64-day cycles.
• Verify that automation tools support frequent, automated renewal processes.
• Update monitoring alerts to detect failed renewals within the shorter timeframe.

What to do and how to stay safe: Let's Encrypt

• Review your certificate management infrastructure to confirm it supports automated renewals every two months.
• Test your renewal scripts in a staging environment to identify failures before the February 2027 deadline.
• Ensure your servers have reliable internet access to communicate with the CA during renewal checks.
• Monitor for any vendor-specific guidance on configuring clients for the new validity period.

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When does the 64-day certificate validity rule take effect?

Let's Encrypt will implement the new 64-day validity period starting in February 2027.

Will existing certificates be revoked immediately?

No, existing certificates will remain valid until their original expiration dates; only new issuances will follow the 64-day rule.

Does this affect paid certificate providers?

This policy change specifically applies to Let's Encrypt's free certificates and does not directly mandate changes for other commercial CAs.