Let’s Encrypt has announced that, from February 2027, newly issued certificates will have a default validity period of 64 days. The move is presented as an interim step ahead of a wider industry transition to 45-day certificate lifetimes.

For European businesses, the announcement matters less as a one-off product update and more as a clear signal that certificate management is becoming a shorter-cycle operational task. Companies that still renew TLS certificates manually may face a higher risk of website outages, service interruptions and avoidable security incidents if they do not improve automation.

What happened

According to the reported announcement, Let’s Encrypt will reduce the default validity period for newly issued certificates to 64 days starting in February 2027. The change comes ahead of an expected move toward 45-day certificate validity periods.

TLS certificates are used to secure websites and online services, enabling HTTPS and helping verify that users are connecting to the intended service. Shorter certificate lifetimes are generally intended to reduce the exposure window if a certificate is mis-issued, compromised or associated with outdated information.

The reported change concerns default certificate duration for newly issued certificates. Businesses should distinguish this announced operational change from any separate policy or browser-industry decisions on maximum certificate lifetimes.

Why it matters for European businesses

Many SMEs, e-commerce businesses and SaaS providers rely on Let’s Encrypt directly or indirectly through hosting platforms, reverse proxies, cloud services and control panels. As certificate validity periods shrink, the tolerance for manual processes becomes much lower.

In practice, shorter lifetimes can create several business risks if certificate operations are not automated properly:

• Website downtime: missed renewals can cause HTTPS errors that make websites appear unsafe or inaccessible.
• Lost sales and leads: certificate failures on e-commerce sites, booking systems or lead-generation forms can interrupt customer journeys.
• Service disruption: APIs, email servers, customer portals and internal applications may also depend on valid certificates.
• Higher operational load: IT teams managing many domains, subdomains or environments will need more reliable renewal monitoring.
• Third-party dependency risk: businesses using agencies, hosting providers or SaaS vendors may need clearer responsibility for certificate lifecycle management.

For companies subject to security expectations under frameworks such as NIS2 or sector-specific requirements, the issue is also governance-related. Certificate expiry is not only a technical inconvenience; it can become a preventable availability and security problem.

Who may be affected

The impact is likely to be highest for organisations that run business-critical web infrastructure and still depend on partial or manual renewal processes.

• SMEs operating their own websites or servers
• E-commerce companies with multiple storefronts, checkout flows or integrations
• IT teams managing customer portals, APIs, VPNs, mail servers or internal tools
• Digital agencies and managed service providers responsible for client hosting and maintenance
• Founders and operations teams at smaller businesses without dedicated security staff

Companies fully using managed platforms may see little direct change if their provider already handles certificate issuance and renewal automatically. Even so, they may still want confirmation that the process is monitored and resilient.

What companies should consider

• Review certificate renewal processes now: identify whether any public-facing or internal service still relies on manual renewal.
• Verify automation end to end: check not only certificate issuance, but also deployment, reloads, fallback behaviour and alerting.
• Map certificate ownership: clarify whether responsibility sits with internal IT, a hosting provider, a developer, an agency or a SaaS vendor.
• Audit critical domains and services: include main websites, subdomains, staging environments, APIs, mail infrastructure and edge services.
• Set expiry monitoring and alerts: independent monitoring can help detect failed renewals before customers are affected.
• Document recovery procedures: if automation fails, teams should know how to restore valid certificates quickly.
• Ask vendors about readiness: businesses relying on third parties should confirm they are prepared for shorter certificate lifecycles.

The immediate announcement does not mean every business must change providers or redesign infrastructure. It does mean that certificate automation is becoming a more important part of routine cyber hygiene. For European businesses that depend on secure websites and digital services, shortening certificate lifetimes raises the cost of weak operational processes and increases the value of reliable automation.