Switch to six day Let's Encrypt certificates only if your renewal is fully automated, monitored, and has already run cleanly for months. They are opt in, valid for 160 hours, and chosen by selecting the shortlived profile in an ACME client. They shrink the window for a stolen key but give you almost no time to fix a failed renewal.
What a short-lived certificate is
Let's Encrypt announced general availability of short-lived and IP address certificates on 15 January 2026. A short-lived certificate is valid for 160 hours, just over six days. Subscribers request one by selecting the profile named shortlived in an ACME client that supports certificate profiles.
They are opt in. The announcement says there is no plan to make them the default at this time, and default lifetimes are heading from 90 days down to 45 days over the next few years, as previously announced.
Why shorter helps
Revocation has historically been the way to limit damage after a private key leaks, and the Let's Encrypt team describes it as unreliable. Relying parties may keep trusting a bad certificate until it expires, which could be up to 90 days. With a six day certificate the exposure window is far smaller.
Short-lived certificates also carry no OCSP or CRL URLs, according to the first-issuance announcement, since expiry does the work revocation would.
What changes in operations
| Question | 90 day certificate | Six day certificate |
|---|---|---|
| Time to fix a failed renewal | Weeks | Hours to a day or two |
| How often the client should run | At least daily is sensible | At least daily, as the announcement recommends |
| Renewal point | A third of lifetime left (about 30 days) | Halfway through lifetime, per the integration guide |
| Revocation info in certificate | CRL | None |
The announcement says short-lived certificates should be renewed every two to three days, and that ARI checks should happen at least once per day.
A readiness checklist
- Renewal has run unattended without a manual fix for several cycles.
- The client reloads the server after each renewal. See reloading nginx without downtime.
- You alert on days remaining at the endpoint, with thresholds measured in hours.
- Challenge validation does not depend on a person or a ticket, for example a DNS API credential that expires.
- Your client supports ACME profiles. The announcement notes that the lego client added this early.
- A fallback exists: you can switch back to the default profile quickly if validation breaks.
When to wait
Wait if renewal runs from a laptop, depends on manual DNS edits, or lives in a pipeline nobody owns. A 90 day certificate forgives those weaknesses, a six day one does not.
Where Safeguard fits
Safeguard does not issue certificates. It helps you inventory what you ship: SBOM and dependency scanning, and policies that gate changes to code that handles TLS. The free scan is at gold.safeguard.sh/scan.
Quick check
How long is a Let's Encrypt short-lived certificate valid?
160 hours, which is just over six days.
Are six day certificates the default?
No. They are opt in, and the announcement says there is no plan to make them the default at this time.
Do short-lived certificates include OCSP or CRL URLs?
The first-issuance announcement states that six day certificates will not include OCSP or CRL URLs.
Sources
- Let's Encrypt, 6-day and IP Address Certificates are Generally Available
- Let's Encrypt, We Issued Our First Six Day Cert
- Let's Encrypt, Integration Guide
Last reviewed: 19 October 2026.
