Let's Encrypt cuts SSL validity to 64 days in 2027, forcing orgs to update automation
The certificate authority will shorten SSL/TLS validity periods, requiring organizations to update automation infrastructure before the change takes effect.
Key points
- Let's Encrypt reduces free SSL/TLS certificate lifetimes to 64 days.
- The new validity period begins in February 2027.
- Organizations must update automation to handle shorter rotation cycles.
Let's Encrypt will reduce the lifetime of its free SSL/TLS certificates to 64 days starting in February 2027, according to Ars Technica. This change affects all new certificates issued by the public certificate authority. Security teams must prepare infrastructure for more frequent certificate rotations.
What is changing with certificate validity?
The standard lifetime for free SSL/TLS certificates issued by Let's Encrypt will drop to 64 days. Previously, these certificates had longer validity periods. This reduction applies to all certificates issued after the February 2027 implementation date. The change forces a higher frequency of renewal processes for all users relying on this authority.
Why is Let's Encrypt making this change?
Let's Encrypt is implementing this reduction to align with industry trends toward shorter certificate lifetimes. Shorter lifetimes limit the window of exposure if a private key is compromised. This approach reduces the risk of long-term misuse of stolen credentials. The authority aims to improve overall security posture through automated, frequent rotation.
How does this affect business operations?
Organizations using Let's Encrypt certificates must update their automation infrastructure to handle 64-day cycles. Manual renewal processes will become unmanageable at this frequency. Systems that rely on static certificate configurations may fail during the transition. Teams need to verify that their deployment pipelines can trigger renewals automatically and frequently enough to prevent service interruptions.
What steps should security teams take?
Security operations teams should audit current certificate management workflows immediately. Ensure that automation scripts can handle the increased renewal frequency without human intervention. Test deployment processes in non-production environments to identify potential failures. Monitor for any errors related to certificate expiration or renewal logic before the February 2027 deadline.
Background: Certificate management
Use automated issuance via ACME protocol for public-facing services to eliminate manual renewal errors. For internal systems, implement centralized inventory tracking with expiration alerts. Delegate complex PKI infrastructure to managed providers to reduce administrative overhead and audit liability.
Read the full guide: Small Business Certificate Management: Avoid Downtime
What to do and how to stay safe: Let's Encrypt
- Audit current certificate automation scripts to ensure they support 64-day rotation cycles.
- Verify that deployment pipelines can automatically renew and install new certificates without manual input.
- Test renewal processes in staging environments to identify potential failure points before the deadline.
- Monitor server logs for certificate expiration warnings and automate alerting for renewal failures.
Step-by-step guide: Browser Security Settings for Small Business Teams
General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When does the 64-day certificate lifetime take effect?
The new 64-day validity period begins in February 2027 for all new Let's Encrypt certificates.
Does this affect existing certificates?
The source material specifies the change applies to new certificates issued after the February 2027 date.
Why are certificate lifetimes being reduced?
Shorter lifetimes reduce the risk window for compromised keys and align with industry security best practices.
