Check that your site renews its certificate automatically. Let's Encrypt says it will cut certificate validity from 90 days to 45 by 2028, with 64 day certificates arriving on its default profile on February 10, 2027. Manual renewal gets painful fast, and a hardcoded 60 day schedule will no longer work.
What is changing
Let's Encrypt is a free, automated and open certificate authority run by the Internet Security Research Group. Its December 2, 2025 announcement says the change follows industry wide requirements from the CA/Browser Forum. The stated dates are:
| Date | Change |
|---|---|
| May 13, 2026 | Opt in tlsserver profile issues 45 day certificates |
| February 10, 2027 | Default classic profile moves to 64 day certificates |
| February 16, 2028 | Classic profile moves to 45 day certificates |
The authorization reuse period also shrinks, from 30 days now to 10 days in 2027 and 7 hours by 2028. That means your system proves control of the domain more often.
Why a small organization should care
Small sites often start with a volunteer who ran a command once and set a reminder. When that volunteer leaves, the reminder goes with them. A lapsed certificate shows visitors a browser warning on your donation page, which looks like a scam to a donor.
Shorter lifetimes make manual renewal a recurring chore. The announcement states that manual renewal is not recommended because it will need to happen more often.
A five step checklist
- Find out who issues your certificate. Look at the lock icon details, or ask your host. Some hosts renew for you.
- Find out how it renews. Is there an automatic job, or a person with a calendar entry?
- Check the schedule. The announcement says renewing at a fixed 60 day interval will not be enough. Renewing about two thirds of the way through a certificate's life is the suggested behavior.
- Look for ARI support. The announcement recommends ACME Renewal Information so your client knows when to renew. Read your client's documentation to see how to enable it.
- Set an alert. Use a free uptime monitor or your host's notice that warns you before expiry, and send it to a shared mailbox, not one person.
If a host manages it for you
Many website builders and managed hosts handle certificates entirely. In that case, your job is to confirm that and to write down who to contact. Do not assume. Ask the support team in writing whether certificates renew automatically.
What to avoid
- Do not treat a green lock as proof the site is safe. It shows an encrypted connection, not a healthy site.
- Do not copy private keys into email or shared chats.
- Do not leave the renewal tied to a personal email address.
Pair this with a note of who owns your domain and DNS, because certificate issuance often depends on proving control of DNS or a web path.
Quick check
Do I need to do anything today?
Not for the date change itself. Confirm that renewal is automatic and that an alert reaches more than one person. That makes the later changes uneventful.
Is a free certificate less secure than a paid one?
Let's Encrypt describes its certificates as trusted and free. The encryption is the same kind. What differs is the renewal routine, which you must automate.
Sources
Last reviewed: 19 October 2026.
