Grep for 83, 80 and 60 Before Certificate Lifetimes Drop to 64 Days

Let’s Encrypt flips its staging environment to 64-day certificates on October 14, 2026. Production follows on February 10, 2027, and every certificate issued or renewed from then gets a 64-day lifetime by default unless the subscriber picks 45 or 6 days. The last 90-day certificate is expected to expire May 11, 2027, and no valid certificate gets revoked.

The fine print is the renewal offset. A script hardcoded to renew 60 days out fires four days after issuance; 80 and 83 never fire before a 64-day certificate expires. Let’s Encrypt recommends roughly two-thirds of the lifetime instead, and suggests grepping cron jobs, wrapper scripts and runbooks. I’d test in staging first.

Skip it if the client implements ACME Renewal Info and does not lean on authorization reuse: ARI lets the CA decide when to renew, and reuse drops from 30 days to 10, then to seven hours in 2028, which only matters to clients built around it. Otherwise, before October, change every fixed renewal offset to two-thirds of the lifetime.