The community-driven non-profit certificate authority Let’s Encrypt, which provides certificates free of charge to anyone interested, has announced a reduction in the validity period of TLS certificates from 90 to 64 days. Starting February 10, 2027, all new and renewed certificates will be issued for 64 days, while the 90-day certificates issued before this date will continue to be valid. Additionally, on February 10, 2027, the authorization period—i.e., the time after confirming rights to a domain during which a certificate can be issued without undergoing repeated checks—will be reduced from 30 to 10 days. From February 16, 2028, the validity of certificates is expected to be further reduced from 64 to 45 days, and the authorization period from 10 days to 7 hours.
The reason for the reduction in certificate validity periods is new requirements from the CA/Browser Forum, developed through the collaborative efforts of browser manufacturers and certificate authorities. A similar reduction in validity periods will be implemented by all certificate authorities. The CA/Browser Forum has set a final deadline for the implementation by March 2029, with a maximum certificate validity of 47 days. After March 2029, processing of new certificates with a validity exceeding 47 days will result in the error message 'ERR_CERT_VALIDITY_TOO_LONG' in browsers.
The shift to short-lived certificates will reduce the time required to implement new cryptographic algorithms in the event of discovered vulnerabilities and will hinder malicious actors from controlling the victim's traffic for an extended period or using certificates for phishing in the event of a certificate leak due to a breach. More frequent ownership checks are set up correctly. and shorter certificate validity periods will also decrease the likelihood that a certificate remains valid after the information it contains becomes outdated and reduce the risk of incorrectly issued certificates being circulated.
Source: opennet.ru
