Page MenuHomePhabricator

Let's Encrypt Decreasing Certificate Lifetimes to 45 Days
Open, MediumPublic

Description

As announced in https://letsencrypt.org/2025/12/02/from-90-to-45.html, LE will decrease the default certificate lifetime from 90 to 45 days. Timeline:

  • May 13, 2026: Let’s Encrypt will switch our tlsserver ACME profile to issue 45-day certificates. This profile is opt-in and can be used by early adopters and for testing.
  • February 10, 2027: Let’s Encrypt will switch our default classic ACME profile to issuing 64-day certificates with a 10-day authorization reuse period. This will affect all users who have not opted into the tlsserver or shortlived (6-day) profiles.
  • February 16, 2028: We will further update the classic profile to issue 45-day certificates with a 7 hour authorization reuse period.

Work to do on acme-chief side:

  • Support ACME Renewal Information (ARI) to auto-detect when acme-chief should renew a certificate instead of the current hardcoded timedelta of 30 days.
  • Support ACME profiles so we can opt-it to 45 days in certain services and test that everything works as expected before the mandatory switch

acme-chief dependencies support

Details

Related Changes in GitLab:
TitleReferenceAuthorSource BranchDest Branch
Update to acme 4.1.0repos/sre/acme-chief!17vgutierrezupdate-acme-4.1.0main
Customize query in GitLab