Let's Encrypt Is Moving to 45-Day Certificates: What Site Owners Should Check

If your website uses a free Let's Encrypt certificate, it will need to renew more often. Let's Encrypt says it will cut the validity of its certificates from 90 days to 45 days by 2028. It says all publicly trusted certificate authorities are making similar changes to follow industry requirements, because shorter lifetimes limit the damage when a certificate is compromised.

The schedule

• May 13, 2026: the opt-in tlsserver profile switched to 45-day certificates, for early adopters and testing.
• February 10, 2027: the default classic profile moves to 64-day certificates, and the authorization reuse period drops to 10 days.
• February 16, 2028: the classic profile moves to 45-day certificates with a 7-hour authorization reuse period.

The authorization reuse period is how long Let's Encrypt accepts an earlier proof that you control a domain. It is currently 30 days. Let's Encrypt says changes reach its staging environment about a month before each production date, and that you'll see the new validity period at your first renewal after each date.

What to check now

1. Automation: Let's Encrypt says most users with automatic renewal won't need to change anything, but you should confirm your client works with shorter lifetimes.
2. Renewal timing: a hard-coded 60-day renewal interval won't work. Let's Encrypt recommends renewing about two-thirds of the way through a certificate's lifetime, or better, using ACME Renewal Information (ARI) so your client knows when to renew.
3. Monitoring: set up alerts for certificates that aren't renewed when expected.
4. No manual renewals: Let's Encrypt advises against renewing by hand, which will be needed more and more often.

If you validate with DNS

More frequent domain validation is hardest for setups that update DNS records. Let's Encrypt says it expects a new validation method, DNS-PERSIST-01, to be available in 2026, designed to make this easier.

On managed hosting?

If your host or CDN manages certificates for you, as most do, ask whether they've tested the shorter schedule. This site uses a managed certificate, so the same question applies to us.

More: Software.