ACME Renewal Information (ARI) is a protocol extension where the certificate authority suggests when your client should renew. It spreads load and lets the CA signal an earlier renewal if needed. Let's Encrypt recommends enabling it, since fixed timers tuned for 90 day certificates will not fit shorter lifetimes.
What it is
RFC 9773, published in June 2025, specifies how an ACME server may provide suggestions to clients about when to try renewing. According to its abstract, this mitigates load spikes and ensures that clients do not make false assumptions about proper renewal periods. Instead of guessing, the client asks the server for a window.
Why it matters now
Let's Encrypt announced that certificate lifetimes will shorten in stages. Its blog post of December 2025 gives these dates:
| Date | Change |
|---|---|
| 13 May 2026 | The tlsserver profile issues 45 day certificates (opt in) |
| 10 February 2027 | The default classic profile moves to 64 day certificates |
| 16 February 2028 | The classic profile moves to 45 day certificates |
The same post warns that renewing at a hardcoded interval of 60 days will no longer be sufficient. For clients without ARI, acceptable behavior is renewing about two thirds of the way through the current certificate's life. It also advises against manual renewal, which would be needed far more often. For the wider picture, see certificate lifetimes.
Checklist
- Find your client and version. Check its documentation for ARI support and how to turn it on, since it differs by client.
- Replace fixed intervals. Search for cron entries and timers with a fixed day count.
- Test against staging first, which gets changes about a month before production. See staging.
- Keep monitoring. ARI does not remove the need for an alert when a certificate is not renewed when expected.
- Audit custom automation. If you wrote your own ACME code, the Let's Encrypt integration guide describes what ARI support looks like.
- Prepare for more frequent validation. The authorization reuse period is also shrinking, so your challenge method will run more often. Think through DNS credential scope now.
What ARI does not fix
It will not repair a broken challenge, a closed port or a web server that never reloads the new file. Those are tested with a dry run.
Where Safeguard fits
Safeguard scans dependencies and SBOMs for known vulnerabilities, including those in the TLS and crypto libraries your projects pull in, and you can try it with the free scan at gold.safeguard.sh/scan.
Quick check
Does ARI replace monitoring?
No. It tells the client when to renew. You still need an alert for renewals that did not happen.
Is a 60 day renewal timer fine for 45 day certificates?
No. Let's Encrypt says a hardcoded 60 day interval will no longer be sufficient.
Sources
- RFC 9773, ACME Renewal Information (ARI) Extension
- Let's Encrypt, Decreasing Certificate Lifetimes to 45 Days
Last reviewed: 19 October 2026.
