The non-profit certificate authority Let’s Encrypt, controlled by the community and providing certificates free of charge to anyone who requests, has announced a phased plan to reduce the validity period of issued TLS certificates from 90 to 45 days. On February 10, 2027, the validity period will be reduced to 64 days, and on February 16, 2028, it will be further reduced to 45 days. An optional feature for obtaining 45-day certificates will be available starting May 13, 2026.
Simultaneously, the authorization validity period will also be gradually reduced — on February 10, 2027, it will be shortened from 30 to 10 days, and on February 16, 2028, from 10 days to 7 hours. The authorization validity period refers to the time after confirming one's rights to domain, during which the certificate can be issued without undergoing re-verification. After this time period expires, new rights confirmation is required.
The reason for shortening the certificate validity periods is attributed to new requirements from the CA/Browser Forum that browser manufacturers and certificate authorities must adhere to. This reduction in validity will be implemented by all certificate authorities. The CA/Browser Forum has set a deadline for the completion of this implementation by March 2029, with a maximum certificate validity period of 47 days. After March 2029, processing in browsers of new certificates with a validity period exceeding 47 days will lead to errors displayed as "ERR_CERT_VALIDITY_TOO_LONG."
Among the advantages of transitioning to short-lived certificates is the capability to reduce the time needed to implement new cryptographic algorithms in case vulnerabilities are detected in currently active ones, as well as an increase in security. For example, in the event of an unnoticed certificate leak due to a breach, short-lived certificates would prevent attackers from controlling the victim's traffic for extended periods or using certificates for phishing. More frequent domain ownership checks and reduced certificate validity periods will also minimize the likelihood that a certificate will continue to be valid after the information it contains becomes outdated, and diminish the risk of misissued certificates being disseminated.
Due to the shortening of the validity period for certificates, Let’s Encrypt has recommended that users not update certificates manually but switch to automated certificate management systems. Users already employing automated systems must ensure their tools correctly support certificates with shortened validity periods. To coordinate timely automatic certificate renewals, administrators can use the ARI (ACME Renewal Information) protocol extension, which allows them to obtain information about the need for certificate renewal and select the optimal time for the updates. It also makes sense to set up a monitoring system to detect situations where a certificate was not renewed in a timely manner.
To simplify domain ownership verification, Let’s Encrypt plans to introduce a new DNS-PERSIST-01 verification method in 2026, which, unlike the HTTP-01 and DNS-01 methods, does not require updating information with each verification and does not require the ACME client to have access to web infrastructure or the DNS server. In PERSIST-01, it is sufficient to add a specific TXT record to the DNS once (‘_validation-persist.example.com. IN TXT(‘ca.example;’ ‘accounturi=https://ca.example/acct/123’)’) and the ACME client will be able to authorize without updating the DNS data.
Source: opennet.ru
