SSL Certificates Are Dropping to 64 Days: What Website Owners Must Do

SSL certificates are getting shorter lifetimes, and website owners need to prepare before their existing renewal processes become unreliable. Let’s Encrypt has confirmed that its default certificate validity will drop from 90 days to 64 days on February 10, 2027. The change affects WordPress websites, online stores, business applications, APIs, and self-hosted infrastructure using Let’s Encrypt certificates.

The important issue is not whether SSL certificates will become more expensive. Let’s Encrypt will remain free. The real concern is whether your hosting environment can renew, install, and activate certificates automatically without interrupting visitors.

Quick answer: Starting February 10, 2027, Let’s Encrypt will issue 64-day SSL certificates by default instead of 90-day certificates. Website owners should enable automated renewal using ACME-compatible tools such as Certbot, Caddy, or managed hosting integrations. Test certificate installation, configure monitoring, and remove manual renewal dependencies. Reliable automation is essential for preventing HTTPS errors and unexpected website outages.

What Is Changing With 64 Day SSL Certificates in 2027?

On October 7, 2026, Let’s Encrypt officially announced its transition to 64-day certificate lifetimes. The announcement was also covered by dev.to’s Dev News Digest on October 9, 2026.

According to Let’s Encrypt, certificates issued or renewed on or after February 10, 2027, will have a default validity of 64 days. Existing 90-day certificates will remain valid until their normal expiration dates.

The organization expects its final 90-day certificates to expire by May 11, 2027. Website owners therefore have several months to inspect their certificate management processes before the transition is complete.

The SSL certificate lifetime timeline

The history is slightly more complicated than a direct change from 398 days to 90 days to 64 days. Let’s Encrypt adopted 90-day certificates years ago, while the broader certificate industry followed different maximum validity limits.

The CA/Browser Forum approved this industry-wide schedule through ballot SC-081v3 in April 2025. The ballot received support from 25 certificate issuers and all four voting certificate consumers, including Apple, Google, Microsoft, and Mozilla.

These dates describe different policies. The 64-day change specifically concerns Let’s Encrypt, while the 200, 100, and 47-day limits apply broadly to publicly trusted TLS certificates.

Why Are SSL Certificate Lifetimes Getting Shorter?

An SSL certificate, technically called a TLS certificate, helps a browser establish an encrypted connection and verify the identity of a website’s domain. Shorter validity periods reduce how long outdated or potentially compromised certificates can remain useful.

Reducing exposure from compromised certificates

Suppose an attacker obtains a website’s TLS private key. Depending on the circumstances, that key could help the attacker impersonate the website or intercept certain connections.

A shorter certificate lifetime limits the period during which the compromised certificate remains valid. It does not instantly revoke the certificate or eliminate the need for proper key management, but it reduces the maximum exposure window.

Keeping domain ownership verification current

Certificate authorities must verify that applicants control the domains listed on their certificates. Domains can change owners, DNS configurations can change, and organizations can lose control of infrastructure.

More frequent issuance creates opportunities for certificate authorities to reassess domain control rather than relying on old validation information indefinitely.

Encouraging automated security operations

According to Let’s Encrypt’s July 2026 published roadmap, its planned 45-day certificate lifetime in February 2028 is designed to comply with tightening industry requirements.

Frequent renewal is practical with automation. ACME-compatible software can request certificates, prove domain control, retrieve new certificates, and deploy them without requiring a human to repeat the process.

Certificate management is only one part of website security. Technologies such as VPN connection protection solve different problems. Our guide explaining what is a VPN kill switch covers how another security mechanism prevents unintended exposure when connections fail.

What Happens If You Keep Renewing SSL Certificates Manually?

Manual renewal becomes increasingly risky as certificates expire more frequently. A website owner might remember an annual renewal, but remembering every several weeks across multiple domains is considerably harder.

A 64-day certificate must be replaced roughly six times per year if renewed near expiration. Renewing earlier provides more time to recover from failed validations or configuration problems.

Common failure scenarios include:

• Expired HTTPS certificates: Browsers display security warnings, discouraging visitors from continuing.
• Failed API requests: Mobile apps, payment systems, and backend services may reject connections.
• Missed domain validation: DNS changes or blocked HTTP challenges prevent certificate issuance.
• Incorrect certificate deployment: The certificate renews successfully, but the web server continues serving the old version.
• Missing renewal notifications: Expiration emails reach an unattended mailbox or are filtered as spam.
• Forgotten subdomains: The main website remains secure while an API, dashboard, or staging environment expires.

For an ecommerce website, an expired certificate can interrupt checkout connections even when the application itself is functioning correctly.

Shorter certificates therefore make it necessary to automate the entire process, not merely the certificate request.

How to Automate SSL Certificate Renewal: Step-by-Step Checklist

The following checklist focuses on an Ubuntu server running Nginx or Apache with Let’s Encrypt. Other hosting platforms use similar principles, although their configuration interfaces differ.

1. Inventory your certificates. Record every production domain, subdomain, certificate issuer, expiration date, and hosting environment. Include API endpoints, staging servers, load balancers, and CDN configurations. For an existing Certbot installation, run the command sudo certbot certificates to inspect certificates managed by that client.
2. Select an ACME-compatible client. ACME is the protocol used to automate certificate issuance and domain validation. Certbot works with common Linux web servers, Caddy provides integrated HTTPS automation, and Traefik supports certificate management for reverse-proxy environments. Check whether your selected client supports ACME Renewal Info, also called ARI.
3. Install and configure Certbot. On Ubuntu, follow the supported installation instructions for your distribution and server setup. For an appropriately configured Nginx installation, sudo certbot –nginx -d example.com -d www.example.com requests a certificate and configures HTTPS. Replace the example domains with your actual hostnames.
4. Enable scheduled renewal. Confirm that Certbot’s systemd timer or equivalent scheduler is active. On systems using systemd, inspect it with systemctl list-timers. Avoid creating duplicate renewal jobs when the package already provides automatic scheduling.
5. Configure deployment and renewal hooks. A successful renewal must reach the running web server. Certbot supports deployment hooks that run after successful certificate renewal. Where your installation does not handle this automatically, use a tested hook such as systemctl reload nginx. Avoid restarting services unnecessarily.
6. Test renewal without issuing a live certificate. Run sudo certbot renew –dry-run to test the renewal process against Let’s Encrypt’s staging environment. Confirm that domain validation succeeds and review the result for configuration errors. Separately verify that your production deployment hook and certificate reload work as intended.
7. Configure expiration monitoring. Use an external monitoring tool such as Uptime Kuma, Zabbix, or Prometheus with Blackbox Exporter. Monitor the certificate actually presented to visitors, not only the file stored on your server. Configure notifications well before expiration and send them to an actively monitored destination.
8. Verify the complete process. Confirm that the correct certificate is installed, HTTPS works across all expected hostnames, the renewal timer continues running, and expiration alerts reach the responsible administrator. Document recovery steps in case automated renewal fails.

Why ACME Renewal Info matters

Traditional renewal scripts often use fixed expiration thresholds, such as attempting renewal 30 days before expiration. Those assumptions become less reliable as certificate lifetimes change.

ACME Renewal Info allows a certificate authority to communicate a recommended renewal window directly to a compatible client.

Let’s Encrypt specifically recommends ARI-aware clients for the 64-day transition. If your client does not support ARI, review its renewal calculations rather than assuming an old fixed schedule remains appropriate.

Let’s Encrypt recommends renewing at approximately two-thirds of the certificate lifetime instead of relying on hard-coded days before expiration. For a 64-day certificate, that corresponds to roughly day 43, leaving around 21 days before expiration.

Which Hosting Platforms Handle SSL Renewal Automatically?

Many website owners already have automated certificate management without realizing it. The important step is confirming which provider owns the renewal process.

Managed WordPress hosting

Managed WordPress platforms often provide SSL certificates through integrated services. If you use a host with automatic HTTPS provisioning, verify that certificate renewal is included and that custom domains receive the same protection.

WordPress plugins cannot reliably fix a certificate that has expired at the server or load-balancer level. Certificate deployment generally belongs to your hosting provider or infrastructure administrator.

Cloudflare, Vercel, and Netlify

Cloudflare manages edge certificates for websites using its proxy services. However, an origin server may still require its own certificate, depending on how the connection between Cloudflare and the origin is configured.

Vercel and Netlify provide managed HTTPS for supported deployments and correctly configured custom domains. Their platforms generally handle routine certificate renewal without requiring developers to install Certbot.

If you are launching a new project, our guide on how to deploy a website for free explains deployment options that can reduce server administration work.

VPS, Docker, and Kubernetes environments

Self-managed servers require greater attention. Caddy is useful when you want HTTPS integrated into the web server, while Traefik can manage certificates for containerized applications.

Kubernetes administrators commonly use cert-manager, which automates certificate issuance and renewal through resources such as Issuer, ClusterIssuer, and Certificate.

For these systems, confirm that certificate secrets update correctly and that ingress controllers or other TLS endpoints use the new certificates.

How to Prepare Your Website Before February 2027

You do not need to wait until February 10 to test your renewal infrastructure. Let’s Encrypt enabled 64-day certificates in its staging environment on October 14, 2026, specifically to help administrators prepare.

Begin with a certificate audit. Determine whether your website uses Let’s Encrypt directly, receives certificates from a hosting provider, or depends on a commercial certificate authority such as DigiCert or Sectigo.

Next, verify that domain validation can complete without manual intervention. HTTP-01 challenges require accessible validation endpoints, while DNS-01 challenges require appropriate DNS control. Wildcard certificates generally use DNS-01 validation.

Finally, test recovery scenarios. Temporarily simulate a failed renewal in a controlled environment and confirm that monitoring detects it. Your operational target should be identifying renewal failures while sufficient certificate validity remains to correct them.

Shorter certificates complement other security practices, including software patching, secure credentials, and vulnerability testing. Our explanation of what is Pwn2Own explores how security researchers demonstrate vulnerabilities in real software and devices.

Frequently Asked Questions

1. Will SSL certificates expire after 64 days in 2027?

Let’s Encrypt certificates issued or renewed from February 10, 2027, will have a default validity of 64 days. This does not mean every certificate authority must issue 64-day certificates. The broader industry maximum becomes 100 days on March 15, 2027. Existing certificates remain valid until their scheduled expiration dates.

2. Do I need to renew my Let’s Encrypt certificate manually every 64 days?

No. Let’s Encrypt supports automatic certificate renewal through ACME-compatible clients such as Certbot, Caddy, and Traefik. Once properly configured, these tools can renew certificates without regular manual action. You should still monitor renewal results and confirm that your server deploys the new certificate successfully.

3. Are 64-day SSL certificates still free?

Yes. Let’s Encrypt will continue providing free TLS certificates after the transition to 64-day validity. The shorter lifetime does not introduce a certificate subscription fee. However, websites using self-managed infrastructure may need additional configuration, monitoring, or administrator time to ensure that certificates renew consistently and securely.

4. What happens if my SSL certificate expires?

Visitors typically encounter browser security warnings indicating that the website’s certificate is invalid or expired. Some applications and API clients will refuse the connection entirely. This can interrupt logins, payment processing, and integrations. Installing a valid certificate and ensuring the server serves it correctly restores certificate-based trust.

5. How can I check if my SSL certificate renews automatically?

Start by checking your hosting dashboard or certificate management tool. For Certbot installations, inspect the renewal scheduler and run a dry-run renewal test. Then verify the certificate’s expiration date through your browser or an external monitoring service. Confirm that renewal failures generate alerts and that the server serves newly installed certificates.

Conclusion: Automate SSL Renewal Before the Deadline

The transition to 64 day SSL certificates is part of a broader effort to make HTTPS certificates shorter-lived and easier to replace when security circumstances change. Let’s Encrypt’s February 10, 2027 deadline is an immediate milestone, with further reductions already planned.

For most website owners, the solution is straightforward: identify who manages your certificates, confirm that ACME-based renewal works, test certificate deployment, and configure independent expiration monitoring.

You do not need to become a certificate authority expert or purchase expensive security software. You need a renewal process that works consistently without depending on someone remembering an expiration date. Automate now, test before February 2027, and monitor every certificate.