On 7 October 2026 Let's Encrypt announced that from 10 February 2027 its certificates will last 64 days by default instead of the current 90. If your host renews the certificate of your site automatically, that is its job and you do nothing. Only someone who renews the certificate on their own and wrote down a fixed number of days before expiry has to change something.
What changes with 64-day certificates
Certificates issued from 10 February 2027 onward last 64 days by default. You can also ask for an even shorter one, of 45 or 6 days, as announced earlier. The last 90-day certificate is expected to expire on 11 May 2027, and valid certificates are not revoked because of the change.
On 14 October 2026 Let's Encrypt starts issuing 64-day certificates in its staging environment, so that the change can be tested. Let's Encrypt writes that preparing for 64 days lays the groundwork for a default lifetime of 45 days in 2028.
The rules of browsers and certificate authorities head the same way. Ballot SC-081v3 of the CA/Browser Forum, adopted by a vote in April 2025, reduces the maximum lifetime of certificates from 398 days to 47 days between March 2026 and March 2029.
Do you need to do anything?
Most site owners do not. When the host takes care of the certificate, it deals with the shorter lifetime itself and you have nothing to change. First find out who renews the certificate, you or the host. How to check the certificate in cPanel is described in the HTTPS guide.
The command below shows who issued the certificate and until when it is valid. Run it from a computer with macOS or Linux and replace primer.bg with your domain. The same details are visible in the browser, in the certificate information of the site.
# Terminal on your computer. Read-only.
# Shows the issuer of the certificate and the dates it is valid between.
openssl s_client -connect primer.bg:443 \
-servername primer.bg </dev/null 2>/dev/null \
| openssl x509 -noout -issuer -dates
The issuer line tells you who issued the certificate. The difference between notBefore and notAfter is its lifetime. Today for a Let's Encrypt certificate it is 90 days, and for those issued from 10 February 2027 onward it will be 64.
What to do if you renew the certificate yourself
This applies to you only if you have your own server and an ACME client, meaning a program such as Certbot that issues and renews the certificate.
- If your client supports ACME Renewal Info (ARI), you are fine. ARI lets Let's Encrypt tell the client when to renew. Check the client's documentation to see whether it has it.
- If renewal is written as a fixed number of days before expiry, change it to about two thirds of the lifetime. For 64 days that is around day 43. Let's Encrypt advises looking in cron jobs, scripts and runbooks for numbers such as 83, 80 or 60.
- When Let's Encrypt starts issuing 64-day certificates in its staging environment on 14 October, test your client there. Automate the server reload after renewal as well.
- The period for reusing the domain validation drops from 30 to 10 days, and in 2028 it will be seven hours. A change is needed only if your client is built to rely on that reuse.
What we do
If the certificate is renewed on your own server, with WordPress maintenance we look after SSL together with the system, PHP and database updates, wherever the server is hosted. If you have a question about the certificate of your site, write to us through the inquiry form.
Frequently asked questions
When do Let's Encrypt certificates become 64-day certificates?
From 10 February 2027. From then on Let's Encrypt certificates last 64 days by default instead of the current 90. Let's Encrypt announced the change on 7 October 2026.
Do I need to do anything about 64-day certificates?
Most site owners do not. If your host renews the site's certificate automatically, it deals with the shorter lifetime as well. A change is needed only if you renew the certificate yourself and set a fixed number of days before expiry.
How do I see who issued my site's certificate and until when it is valid?
On a computer with macOS or Linux, openssl s_client -connect primer.bg:443 -servername primer.bg with your domain, piped into openssl x509 -noout -issuer -dates, shows the issuer and the dates. The issuer line tells you who issued the certificate, and the gap between notBefore and notAfter is its lifetime. The browser shows the same details in the site's certificate information.
Will current 90-day certificates stop working?
No. Valid Let's Encrypt certificates are not revoked because of the change. The last 90-day certificate is expected to expire on 11 May 2027.
After how many days should I renew a 64-day certificate?
If renewal is set as a fixed number of days, change it to about two thirds of the lifetime, which for 64 days is around day 43. Let's Encrypt advises searching cron jobs, scripts and runbooks for numbers such as 83, 80 or 60.
What is ACME Renewal Info (ARI)?
ARI lets Let's Encrypt tell an ACME client, such as Certbot, when to renew a certificate. If your client supports ARI, you do not need to change anything for 64-day certificates. The client's documentation says whether it does.
How can I test renewal before February 2027?
From 14 October 2026 Let's Encrypt issues 64-day certificates in its staging environment, so your client can be tested there. Automate the server reload after renewal while you are at it.
Will certificates get even shorter?
Yes. Let's Encrypt writes that preparing for 64 days lays the groundwork for a 45-day default in 2028, and certificates of 45 or 6 days can already be requested. Ballot SC-081v3 of the CA/Browser Forum, adopted in April 2025, cuts the maximum certificate lifetime from 398 to 47 days between March 2026 and March 2029.