Digital certificates are a fundamental part of internet security. They help websites establish encrypted connections, authenticate their identities, and protect information exchanged between users and online services.
However, managing certificates securely is becoming more demanding as the industry moves toward shorter certificate lifetimes.
Let’s Encrypt, one of the world’s largest certificate authorities, has announced that it will reduce the default validity of newly issued certificates from 90 days to 64 days in February 2027, followed by a further reduction to 45 days in February 2028.
This change highlights an important cybersecurity priority for organizations: certificate management must evolve from a periodic administrative task into a reliable, automated, and continuously monitored security process.
What Is Changing at Let’s Encrypt?
According to Let’s Encrypt’s October 2026 announcement, the transition will take place in stages.
The key milestones are:
- October 14, 2026: Let’s Encrypt plans to begin issuing 64-day certificates in its staging environment so administrators can test their systems.
- February 10, 2027: The default certificate lifetime for newly issued and renewed certificates will become 64 days.
- February 16, 2028: The default lifetime will decrease further to 45 days.
Let’s Encrypt expects the last certificates issued under the existing 90-day default to expire by May 11, 2027. The change does not mean that currently valid certificates will be revoked simply because the new policy is introduced.
The transition is part of a broader industry effort to shorten the maximum validity period of publicly trusted TLS certificates.
Why Are Certificate Lifetimes Getting Shorter?
TLS certificates help establish encrypted HTTPS connections between websites and users. They also support trust in online services, APIs, and other internet-facing systems.
Reducing certificate lifetimes offers several security benefits.
1. Limiting the Impact of Compromised Keys
If a certificate’s private key is compromised, a shorter validity period can reduce the time during which the certificate remains valid without replacement or other intervention.
Shorter lifetimes do not eliminate the need to revoke compromised certificates or replace affected keys, but they can help limit exposure.
2. Reducing the Window for Mis-Issued Certificates
Certificates can occasionally be issued incorrectly or under circumstances that later require remediation.
Shorter validity periods reduce how long such certificates can remain valid, although prompt detection and appropriate revocation remain important.
3. Encouraging Better Security Automation
Shorter certificate lifetimes make manual renewal processes increasingly difficult to maintain reliably.
Organizations must be able to issue, renew, deploy, and monitor certificates consistently without relying on administrators to remember recurring deadlines.
4. Improving Certificate Lifecycle Discipline
Frequent renewal encourages organizations to maintain better visibility into certificate inventories, ownership, expiration dates, deployment processes, and operational dependencies.
These improvements can strengthen security beyond the certificate itself.
The Biggest Challenge: Certificate Automation
For many organizations, the most significant challenge will not be obtaining a new certificate. It will be ensuring that every certificate is renewed and deployed correctly across all relevant systems.
Modern enterprises may manage certificates across:
- Public websites and customer portals
- Cloud applications and load balancers
- API gateways and microservices
- Kubernetes clusters and containerized workloads
- Reverse proxies and web servers
- Internal applications and service endpoints
- Development, testing, and production environments
- Multiple domains and business units
A failure in any part of the renewal process can create unexpected consequences.
An expired certificate may cause browser warnings, failed API requests, broken integrations, interrupted transactions, or unavailable business services. A certificate that renews successfully but is not deployed or loaded by the relevant service can create similar problems.
Organizations therefore need to automate the entire lifecycle, not merely the certificate request.
ACME Renewal Information Can Help
Let’s Encrypt recommends using ACME Renewal Information, commonly known as ARI, where supported by the certificate client.
ARI allows the certificate authority to communicate appropriate renewal timing to compatible clients. This helps renewal systems respond to certificate lifecycle requirements without relying exclusively on fixed dates.
Organizations whose renewal scripts use hard-coded timing should review and update those rules. Let’s Encrypt recommends scheduling renewal at approximately two-thirds of the certificate’s lifetime when using a fixed lifetime-based approach.
The change also creates an opportunity to automate certificate deployment, service reloads, and alerts for failed renewals.
Testing in the staging environment before production changes take effect is an important step.
Another Important Change: Shorter Authorization Reuse Periods
Certificate validity is not the only part of the process changing.
Let’s Encrypt plans to reduce the authorization reuse period, which determines how long previously completed domain-control validation can be reused for subsequent issuance.
The planned changes are:
- From 30 days to 10 days in February 2027.
- From 10 days to seven hours in February 2028.
These reductions mean that certificate issuance workflows may need to complete domain validation more frequently.
Organizations should review how their ACME clients perform validation, especially where DNS changes, access restrictions, manual approval steps, or third-party integrations are involved.
For larger deployments, certificate renewal and domain validation should be treated as connected automation workflows with appropriate monitoring and recovery procedures.
What Organizations Should Do Now
Organizations do not need to wait until 2027 to prepare. The following actions can help reduce the risk of outages and certificate-related security issues.
1. Inventory All Certificates
Identify certificates across public websites, cloud environments, APIs, internal services, and business applications.
Record expiration dates, certificate owners, issuing authorities, deployment locations, and dependencies.
2. Audit Renewal Automation
Review ACME clients, cron jobs, scheduled tasks, scripts, configuration files, and operational runbooks.
Look for hard-coded renewal intervals that assume certificates remain valid for 90 days.
3. Test Against the New Lifetimes
Use Let’s Encrypt’s staging environment to validate issuance, renewal, deployment, and recovery workflows before the production transition.
Testing should include failure scenarios, not just successful renewal.
4. Automate Certificate Deployment
Ensure renewed certificates are correctly installed and that affected services reload or restart when necessary.
A successful issuance is not enough if applications continue using an expired certificate.
5. Implement Monitoring and Alerting
Track certificate expiration, renewal failures, deployment errors, validation problems, and unexpected changes.
Alerts should reach the teams responsible for resolving certificate issues before services are affected.
6. Review Domain Validation Dependencies
Evaluate DNS automation, web server access, API permissions, and other requirements used to prove domain control.
Pay particular attention to workflows that rely on manual intervention or long authorization reuse periods.
7. Establish Recovery Procedures
Document how to recover from failed renewals, incorrect deployments, certificate mismatches, and private-key compromise.
Test these procedures to ensure that teams can respond quickly.
8. Protect Private Keys
Use appropriate access controls, secure storage, least privilege, and key rotation procedures.
Shorter certificate lifetimes are not a substitute for protecting private keys or responding promptly to suspected compromise.
Industries That Should Pay Attention
Financial Services and Banking
Banks, fintech companies, payment providers, and investment firms depend on secure websites, APIs, digital banking platforms, and transaction services.
COE Security can help these organizations assess TLS configurations, review certificate inventories, test internet-facing applications, and strengthen monitoring to reduce the risk of certificate-related service disruption.
Healthcare and Life Sciences
Healthcare providers and life sciences organizations use certificates to secure patient portals, healthcare applications, APIs, and connected services.
We help assess application and infrastructure security, review certificate-related risks, strengthen data protection, and support compliance-focused cybersecurity initiatives.
Retail and E-commerce
Online retailers rely on HTTPS, payment integrations, customer accounts, and third-party services to maintain secure shopping experiences.
COE Security can help assess web application security, API configurations, certificate deployment processes, and monitoring practices to reduce exposure to security weaknesses and avoid preventable service interruptions.
Manufacturing and Industrial Organizations
Manufacturers increasingly rely on cloud platforms, connected applications, remote access systems, and digital supply chains.
We help assess network and application security, review infrastructure configurations, test exposed services, and identify weaknesses that could affect operational continuity.
Government and Public Sector
Government websites and public-facing services must maintain secure communications and reliable access to digital services.
COE Security can support infrastructure security assessments, TLS configuration reviews, vulnerability management, penetration testing, and incident response readiness.
Technology and SaaS Companies
Technology providers often manage large numbers of certificates across APIs, microservices, cloud infrastructure, and customer-facing applications.
We help assess certificate management practices, secure application environments, review deployment processes, and strengthen monitoring and operational resilience.
Conclusion
Let’s Encrypt’s transition to 64-day certificates in 2027 and 45-day certificates in 2028 reflects a broader shift toward shorter-lived digital credentials and more reliable automation.
The change can improve security by reducing the period during which compromised or mis-issued certificates remain valid. However, it also places greater importance on certificate inventory management, automated renewal, reliable deployment, domain validation, and continuous monitoring.
Organizations that depend on secure digital services should begin reviewing their certificate management processes now rather than waiting for the new defaults to take effect.
The future of certificate security will depend not only on shorter validity periods, but also on how effectively organizations automate, monitor, and manage the entire certificate lifecycle.
About COE Security
COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.
Our offerings include:
- AI-enhanced threat detection and real-time monitoring
- Data governance aligned with GDPR, HIPAA, and PCI DSS
- Secure model validation to guard against adversarial attacks
- Customized training to embed AI security best practices
- Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud)
- Secure Software Development Consulting (SSDLC)
- Customized CyberSecurity Services
- Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption.
In addition, COE Security helps organizations strengthen certificate and infrastructure security through web application assessments, TLS configuration reviews, API security testing, cloud security assessments, vulnerability management, penetration testing, secure development consulting, and security monitoring.
For financial services and banking organizations, we help assess digital banking platforms, APIs, internet-facing services, and security configurations to identify weaknesses and reduce operational risk.
For healthcare organizations, we help assess patient-facing applications, connected services, infrastructure security, and data protection controls while supporting relevant compliance requirements.
For retail and e-commerce businesses, we help assess customer-facing applications, payment integrations, APIs, cloud infrastructure, and web security configurations to support secure and reliable digital transactions.
For manufacturing and industrial organizations, we help evaluate network infrastructure, connected applications, remote access environments, and operational technology security to identify vulnerabilities and improve resilience.
For government and public-sector organizations, we help strengthen public-facing applications, infrastructure security, vulnerability management, security monitoring, and incident response readiness.
For technology and SaaS companies, we help assess cloud infrastructure, APIs, application security, deployment configurations, and certificate-related risks as part of broader cybersecurity reviews.
Our goal is to help organizations identify security gaps, reduce cyber risk, strengthen resilience, protect sensitive information, and maintain compliance across increasingly connected digital environments.
Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption, emerging cybersecurity developments, infrastructure security, and practical strategies to stay updated and cyber safe.
Click to read our LinkedIn feature article