What Breaks When Let’s Encrypt Moves to 64-Day Certificates

Your ACME client will be fine on Feb 10. Calendar crons, 30-day alerts and DNS-01 setups won’t, and you can fix all three on staging now.

Where three common renewal schedules fire on a 64-day Let’s Encrypt certificate. Image by the author.

Since October 14, 2026, Let’s Encrypt’s staging environment has issued 64-day certificates instead of 90-day ones. Production follows on February 10, 2027, and your ACME client will most likely handle it fine.

What breaks is everything built around that client while 90 was a constant: the cron that renews on the 1st of every other month, the alert that fires at “30 days left”, and the DNS credentials that are about to get used more often.

What most of us think decides renewal

Most engineers carry a simple model: certificates last 90 days, the client renews 30 days before expiry, and you get a month to notice a failure. Shorter certificates just mean tightening one number.

It’s a reasonable belief, because it was literally certbot’s behavior until version 4.0, and plenty of runbooks and alerts copied that 30.

You’ll also read that a 30-day threshold “halves your safety margin” on a 64-day certificate. Run the numbers and it’s the other way round: it renews at day 34…