Public TLS certificates are about to get much shorter, and the next deadlines are close. The longest a public certificate may last fell from 398 to 200 days on 15 March 2026, drops to 100 days on 15 March 2027 and to 47 days on 15 March 2029. Let's Encrypt, which issues the free certificates behind a large share of the web, moves its default from 90 to 64 days on 10 February 2027. Anything that renews on a fixed schedule or by hand will start failing. This guide gives the dates, what the data says about who is not ready, and a short audit you can do this week. Facts come from the sources linked, read on 11 November 2026.
The schedule
| From | Longest public TLS certificate (CA/Browser Forum) | Let's Encrypt default |
|---|---|---|
| Before 15 March 2026 | 398 days | 90 days |
| 15 March 2026 | 200 days | 90 days |
| 10 February 2027 | 200 days | 64 days |
| 15 March 2027 | 100 days | 64 days |
| 16 February 2028 | 100 days | 45 days |
| 15 March 2029 | 47 days | 45 days |
Sources: the 398, 200, 100 and 47-day limits are from the CA/Browser Forum's Ballot SC-081, as summarized by InternetData and Certimon. The Let's Encrypt dates are from its announcement. The limits apply to newly issued publicly trusted TLS server certificates; existing certificates are not shortened by the dates alone, and private PKI can follow its own policy (Certimon).
What Let's Encrypt is changing
- 13 May 2026: the opt-in
tlsserverprofile issues 45-day certificates, for early testing. - 10 February 2027: the default
classicprofile switches to 64-day certificates, with the authorization reuse period cut from 30 to 10 days. This affects everyone who has not chosen thetlsserveror 6-dayshortlivedprofile. - 16 February 2028: the
classicprofile moves to 45 days, with authorization reuse of 7 hours.
Testing of the 64-day certificates opened on 14 October 2026 (Ars Technica). Let's Encrypt's own advice: renew at about two-thirds of the certificate's lifetime, or let the CA say when through ACME Renewal Information (ARI), and search your cron jobs, scripts and runbooks for hard-coded renewal offsets such as 83, 80 or 60 days.
Who is not ready: what the scan shows
InternetData scanned IPv4 hosts on port 443 on 22 October 2026. Of 25,481,947 hosts with a browser-trusted certificate, 35.5% were on a certificate of 100 days or less, 43.6% on 101 to 200 days and 20.9% still on one over 200 days (issued before the March 2026 cap). Of the hosts on a 101-to-200-day certificate, 3,111,164 (28.0%) were already past day 100, which means a 100-day certificate issued the same day would have expired.
For Let's Encrypt specifically, 7,474,376 hosts hold a 90-day certificate; 303,967 (4.1%) were on one older than 64 days, a renewal that would come too late once certificates last 64 days. The same scan found 3,791,763 hosts (10.2%) presenting an expired certificate, and 11.4% of the hosts with a Let's Encrypt certificate were among them (InternetData). A hosts-by-IP count overstates websites, since one certificate can sit on many addresses, but the direction is clear: a large share of servers renew late today.
A one-week audit
- List every public certificate and where it is renewed. Web servers, load balancers, mail servers, VPN and firewall appliances, panels, CDNs. Check expiry with
echo | openssl s_client -connect host:443 -servername host 2>/dev/null | openssl x509 -noout -dates. - Find hard-coded renewal offsets. Search cron, systemd timers, CI jobs and runbooks for 30, 60, 80 and 83. Change them to renew at two-thirds of the lifetime or use ARI.
- Check your ACME client. Confirm it supports ARI and update it if not.
- Find the manual ones. Any device where someone uploads a certificate by hand will need a process every 64 days from February, and every 45 days in 2028. Ask vendors for an API, a hook or ACME support.
- Alert on failure, not just expiry. Notify on a failed renewal days before the certificate expires.
- Test early. Use Let's Encrypt's testing window, or set a test host to the
tlsserverprofile, to see whether your automation survives shorter lifetimes. - Do not forget non-public certificates. Internal CAs follow their own policy, but anything moving to a public CA inherits these limits.
For wildcard certificates shared across servers, which are the hardest case, see wildcard certificates on multiple servers: how to renew them. For another certificate deadline that already bit administrators, read the Secure Boot certificate expiry guide, and for what certificate trust problems look like in practice Docker registry x509 errors. The other long-term crypto deadline is in post-quantum TLS in 2026.
Frequently asked questions
When do Let's Encrypt certificates become 64 days? From 10 February 2027 for the default profile, at your next renewal after that date.
Will my existing certificate be shortened? No. The new limits apply to newly issued certificates.
What is the longest public certificate allowed now? 200 days since 15 March 2026. It becomes 100 days on 15 March 2027 and 47 days on 15 March 2029.
What is ARI? ACME Renewal Information lets the certificate authority tell your client when to renew, so you do not hard-code a schedule.