Stay on classic if you want the behaviour you already have. Choose tlsserver if you are fully automated and want a 45 day certificate with a smaller body. Choose shortlived if your renewal is proven and you want a window of about six days. The default is classic when you request nothing.
What a profile is
A profile is a bundle of characteristics covering two things: the validation process needed to get a certificate, and the contents of the certificate you receive. Let's Encrypt says most subscribers never need to think about it, because the default is selected for them. The list the ACME server advertises in its directory endpoint is the canonical one, and some profiles can be limited to staging or temporarily allowlisted.
The three profiles side by side
Values below come from the profiles page last updated on 4 October 2026.
| Property | classic | tlsserver | shortlived |
|---|---|---|---|
| Validity | 90 days | 45 days | About 6 days |
| Pending authorization lifetime | 7 days | 1 hour | 1 hour |
| Authorization reuse period | 30 days | 7 hours | 7 hours |
| Order lifetime | 7 days | 8 hours | 8 hours |
| Common Name in certificate | Yes | No | No |
| Revocation information | CRL | CRL | None, per the announcements |
| Maximum names | 100 | 25 | 25 |
The shortlived row on revocation and names follows the page's statement that it is identical to tlsserver apart from lifetime, plus the earlier announcement that six day certificates carry no OCSP or CRL URLs. Verify the live page before relying on any single cell.
Why tlsserver trims the certificate
The page explains each omission. The Common Name is redundant with the Subject Alternative Names, and the CA/Browser Forum Baseline Requirements mark it as not recommended. Key Encipherment is only relevant for non-forward-secret cipher suites that major browsers have removed. The Subject Key ID has no purpose in end-entity certificates. The 45 day validity prepares for upcoming limits that cap all certificates at 47 days.
The shorter authorization lifetime pushes automation: a script can finish a challenge in seconds, so an hour is plenty. The seven hour reuse period exists because CAA must be rechecked after eight hours.
What can break
- A system that reads the Common Name instead of the SAN. Fix the consumer, see hostname verification.
- A certificate that needs more than 25 names. Split it, or stay on classic.
- Anything that validated challenges days ahead. Authorizations now expire within hours.
- A deploy process that takes longer than the renewal window on short lifetimes.
How to choose
- Test on staging first, where profiles may be available before production.
- Check your ACME client supports selecting a profile.
- Move one low risk host to tlsserver and watch two renewals.
- Only then consider shortlived, using the six day readiness checklist.
Where Safeguard fits
Safeguard does not manage certificate profiles. It provides SBOM and dependency scanning and policy gates so TLS related code changes get reviewed. Free scan: gold.safeguard.sh/scan.
Quick check
Which profile is the default?
classic. It applies to every order that does not request a specific profile.
Why does tlsserver drop the Common Name?
It duplicates the Subject Alternative Names and the Baseline Requirements mark it as not recommended.
How do I know which profiles exist right now?
Read the profile list in the ACME server directory. The documentation calls it the canonical list.
Sources
Last reviewed: 19 October 2026.
