timetobail
My stack

Let's Encrypt · Forced move · Tracked since October 13, 2026 · Sources checked Oct 13

Time to bail on Let's Encrypt certificates on the default profile?

Time to Bail · Boarding pass

FromLet's Encrypt certificates on the default profile
ToYour pick

Act. You can stay.

Default certificates last 64 days from February 10, 2027. A fixed 60-day renewal will fail.[1]

Act means: change a setting or plan before the date. You can stay.

Gate closes
Default certificates become 64 days
Time left
117days
Status
Act

Let's Encrypt certificates last 64 days from February 10, 2027

From February 10, 2027, Let's Encrypt's default profile issues 64-day certificates. From February 16, 2028, it issues 45-day ones. Renewing every 60 days will no longer be enough.

What to do before February 10

Tick steps as you go. Your progress stays in this browser.

  1. Check how you renew

    Look at your ACME client settings. Note any fixed renewal interval.

  2. Turn on ARI or renew earlier

    Use an ACME client that supports ARI, or renew about two thirds of the way through each certificate's life.

  3. Test on staging first

    Let's Encrypt staging gets changes about a month early. Run your renewals there.

Facts we checked

Facts and their sources
Default certificates become 64 daysFebruary 10, 2027[1]
Default certificate lifetime from then64 days[1]
Authorization reuse from then10 days (now 30 days)[1]
Next step45-day certificates from February 16, 2028, with 7 hour authorization reuse[1]
Opt-in 45-day profile (tlsserver)Since May 13, 2026[1]
Fixed renewal timersRenewing every 60 days will no longer be sufficient[1]
Let's Encrypt recommendsACME Renewal Information (ARI), or renewing about two thirds of the way through[1]
Staging gets changesAbout a month before production[1]
Industry rule (CA/Browser Forum)Maximum validity falls from 398 days to 47 days between March 2026 and March 2029[2]
Sites that renew on a fixed 60-day timerWill have expired certificates[1]

Sources

Check it yourself. Every fact above links here.

  1. Decreasing Certificate Lifetimes to 45 Days Let's Encrypt · primary · checked Oct 13
  2. Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods CA/Browser Forum · primary · checked Oct 13
Read the published editorial report

What changed

Time to bail on Let's Encrypt certificates on the default profile? Act. You can stay. Default certificates last 64 days from February 10, 2027. A fixed 60-day renewal will fail.

On our scale this is Act: change a setting or plan before the date. You can stay.

From February 10, 2027, Let's Encrypt's default profile issues 64-day certificates. From February 16, 2028, it issues 45-day ones. Renewing every 60 days will no longer be enough.

Here are the facts we checked:

  • Default certificates become 64 days: February 10, 2027 (Let's Encrypt)
  • Default certificate lifetime from then: 64 days (Let's Encrypt)
  • Authorization reuse from then: 10 days (now 30 days) (Let's Encrypt)
  • Next step: 45-day certificates from February 16, 2028, with 7 hour authorization reuse (Let's Encrypt)
  • Opt-in 45-day profile (tlsserver): Since May 13, 2026 (Let's Encrypt)
  • Fixed renewal timers: Renewing every 60 days will no longer be sufficient (Let's Encrypt)
  • Let's Encrypt recommends: ACME Renewal Information (ARI), or renewing about two thirds of the way through (Let's Encrypt)
  • Staging gets changes: About a month before production (Let's Encrypt)
  • Industry rule (CA/Browser Forum): Maximum validity falls from 398 days to 47 days between March 2026 and March 2029 (CA/Browser Forum)
  • Sites that renew on a fixed 60-day timer: Will have expired certificates (Let's Encrypt)

You can stay on Let's Encrypt. You have to change a setting or plan before the date.

Leaving is a choice here, not a must.

Let's Encrypt is the main source for this page. Let's Encrypt has not said more than what is listed here. If a fact is not on this page, we do not know it yet.

Who is affected

Sites that renew on a fixed 60-day timer: Will have expired certificates.

The date to remember is February 10, 2027. Make the change before then.

What to do before February 10

  1. Check how you renew. Look at your ACME client settings. Note any fixed renewal interval.
  2. Turn on ARI or renew earlier. Use an ACME client that supports ARI, or renew about two thirds of the way through each certificate's life.
  3. Test on staging first. Let's Encrypt staging gets changes about a month early. Run your renewals there.

A few tips:

  • Make the change yourself before the date. Do not wait for the last reminder email.
  • Write down your current plan or settings first, so you can compare after the change.
  • After the change, open your settings again and check that it worked.

How to tell your users

If the change affects your members or team, send one short email. Say what changes for them and when. Put the most important line first.

If there is a date, send a short reminder a few days before it. Keep a copy of the list you sent it to.

Options people mention

Listed for convenience. Not ranked. Not paid. These names come up in threads and reviews; that does not show where people moved.

Before you pay, check the price page of each tool yourself. Prices change, and we only list what our sources say.

Questions people ask

No questions collected yet.

Sources

Thanks.

Did this answer your question?

Run SaaS spend at work? Get these changes before the invoice

Arrivals · for builders

Building where they land?

People on Let's Encrypt certificates on the default profile can stay if they make the change. Some would rather leave. Get the playbook for this change, and list your product here.

Listing is free. An editor checks it. Not ranked. Not paid.

Open the playbookList your product