You’re telling me Let’s Encrypt is down to 45 days?

You’re telling me Let’s Encrypt is down to 45 days?

Quite a few users have asked us recently: “I heard Let’s Encrypt certificates are moving to a 45-day lifetime? Do I have to renew them all the time from now on?” Hold on — let’s get this straight today: the 45-day lifetime is a plan for 2028, and the transition will be staged. For now there is no reason to worry about certificates “suddenly expiring”.

The core change: certificate lifetimes drop to 45 days from 2028

Let’s Encrypt has confirmed that certificates currently last 90 days and will gradually move to 45 days by 2028. This is not an ad-hoc decision: it aligns with the industry standard from the CA/Browser Forum, which every publicly trusted CA has to follow. Shortening lifetimes serves two purposes. First, it limits the impact of potential security flaws. Second, it makes certificate revocation more effective — a shorter lifetime means a smaller risk window.

In addition, the authorization reuse period (how long a verified domain control check allows new certificates to be issued quickly for the same domain) will shrink along with it: it is currently 30 days and will be cut to just 7 hours in 2028. That means domain control will have to be re-confirmed far more often, further tightening the security of domain ownership. (See figure 1: the Let’s Encrypt announcement on certificate lifetime changes.)

A staged transition: no “emergency action” needed

To limit the impact, Let’s Encrypt will let users control the pace of change through ACME profiles, and every adjustment will be validated in a testing environment first before being rolled out to production gradually. The timeline:

• 13 May 2026: the tlsserver profile can be enabled optionally, issuing 45-day certificates (suitable for users who want to test early);
• 10 February 2027: the default classic profile will issue 64-day certificates (with a 10-day authorization reuse period); users who have not switched profiles manually will receive this transitional setup;
• 16 February 2028: the classic profile is finally updated to a 45-day lifetime plus a 7-hour authorization reuse period, and every user who has not customized their configuration will follow it.

Put simply, users only see the change at their next renewal, and can respond flexibly by adjusting their ACME client configuration. (See figure 2: the staged timeline of the Let’s Encrypt certificate changes.)

In short, the 45-day lifetime is a long-term plan for 2028, and there are nearly three years to prepare. Ordinary users do not need to panic: just follow the official announcements and adjust the configuration as needed. Security upgrades take some getting used to, but in the long run this step makes the internet’s trust system more solid — after all, a shorter certificate cycle means risks are blocked sooner, and in the end every one of us online benefits.

(This article draws on the official Let’s Encrypt announcement, by Matthew McPherrin, published on 2 December 2025.)