Let’s Encrypt is cutting its default certificate lifetime from 90 days to 64, starting February 10, 2027. If anything in your setup renews on a hardcoded schedule, that’s the day it quietly stops working.
The dates
Staging already switched on October 14, so you can test against it now. Production flips February 10, 2027, and certificates issued or renewed on or after that date come back with 64 days of validity. The last 90-day certificate should expire May 11, 2027.
Nothing gets revoked. Existing certificates run out their full term.
If you want shorter, 45-day and 6-day options exist. The default move to 45 days is planned for 2028.
The part that actually breaks things
If your ACME client supports ACME Renewal Info, you’re fine. ARI lets Let’s Encrypt tell the client when to renew, so a lifetime change propagates on its own.
The problem is everything that doesn’t ask. A cron job that renews at 83 days, a script with --days 60 baked in, a runbook step somebody wrote once and never revisited. Those keep using a number that no longer fits inside the certificate’s life, and the first symptom is an expired cert in front of something you need.
Let’s Encrypt’s own advice is to go grep your cron jobs, scripts and runbooks for hardcoded values like 83, 80 or 60, and switch to renewing at roughly two thirds of the lifetime. For 64 days that’s about day 43.
Worth doing now while it’s an afternoon of grepping, rather than in February when it’s an outage.
One more thing buried in the announcement
Authorization reuse drops from 30 days to 10. In 2028 it goes to seven hours.
Most people won’t notice, because most ACME clients revalidate anyway. If you’ve built something that leans on validation reuse to avoid re-proving domain control, that assumption has a shelf life now.
Why this keeps happening
Certificate lifetimes have been shrinking for a decade and the direction is not going to reverse. The whole argument for short-lived certificates is that revocation has never really worked, so the fallback is making every certificate expire before a stolen key stays useful for long.
The practical consequence for anyone self-hosting: renewal has to be something you never touch, not something you maintain. Any step in your certificate path that needs a human to remember a number is a step that will eventually fail on a weekend. If a lifetime change can break your setup, the setup was already fragile and this is just the thing that found it.