{"id":2918,"date":"2026-10-29T09:28:36","date_gmt":"2026-10-29T09:28:36","guid":{"rendered":"https:\/\/hostry.com\/blog\/?p=2918"},"modified":"2026-10-29T09:28:37","modified_gmt":"2026-10-29T09:28:37","slug":"lets-encrypt-45-day-certificates","status":"publish","type":"post","link":"https:\/\/hostry.com\/blog\/lets-encrypt-45-day-certificates\/","title":{"rendered":"Let’s Encrypt 45-Day Certificates: Automate Renewal Before 2027"},"content":{"rendered":"\n
\"Let's<\/figure>\n\n\n\n
Let's Encrypt cuts its default certificate lifetime from 90 to 64 days on February 10, 2027, and to 45 days on February 16, 2028. If certbot or acme.sh already renews on its own, test it and add an expiry alert. Manual renewals, fixed 60-day cron jobs and certificates copied to other machines need fixing now.<\/strong><\/em><\/pre>\n\n\n\n
You do not have to wait for 2028 to see how your servers handle Let’s Encrypt 45-day certificates<\/strong>: an opt-in profile has issued them since May 13, 2026, and the staging environment has issued 64-day certificates since October 14, 2026. On cPanel web hosting<\/a><\/strong> with free automatic SSL, the panel handles renewal and you have nothing to change.<\/p>\n\n\n\n
When Let’s Encrypt 45-day certificates become the default<\/h2>\n\n\n\n
Let’s Encrypt announced the schedule in its December 2025 post on moving from 90 to 45 days<\/a><\/strong>. The change runs through ACME profiles: classic<\/span> is what every client gets unless it asks for something else, and tlsserver<\/span> is the opt-in profile for early adopters.<\/p>\n\n\n\n
Date<\/th>Profile<\/th>Certificate lifetime<\/th>Authorization reuse<\/th><\/tr><\/thead>
Until February 9, 2027<\/td>classic (default)<\/td>90 days<\/td>30 days<\/td><\/tr>
Since May 13, 2026<\/td>tlsserver (opt-in)<\/td>45 days<\/td>7 hours<\/td><\/tr>
February 10, 2027<\/td>classic (default)<\/td>64 days<\/td>10 days<\/td><\/tr>
February 16, 2028<\/td>classic (default)<\/td>45 days<\/td>7 hours<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Authorization reuse shrinks too, and that matters as much as the lifetime: today a client can often renew on a validation done weeks earlier. At 7 hours, almost every renewal has to pass a fresh HTTP-01 or DNS-01 challenge, so a broken validation path shows up at the next renewal instead of hiding behind an old authorization.<\/p>\n\n\n\n
The new lifetimes apply to newly issued certificates, so you meet each one at your first renewal after the date. Existing certificates are not revoked. According to the Let’s Encrypt announcement of 64-day certificates<\/a><\/strong>, the last 90-day certificate should expire around May 11, 2027.<\/p>\n\n\n\n
CA\/Browser Forum ballot SC-081v3<\/a><\/strong>, passed in April 2025, reduces the maximum validity of every publicly trusted TLS certificate from 398 days to 47 days in steps between March 2026 and March 2029, so a shorter SSL certificate lifetime<\/strong> reaches paid certificates too.<\/p>\n\n\n\n
Who needs to do something?<\/h2>\n\n\n\n