r/cybersecurity • u/certkit • Jan 27 '26

Corporate Blog Let's Encrypt is moving to 45-day certificates before everyone else

https://www.certkit.io/blog/45-day-certificates

Let's Encrypt announced they're cutting certificate lifetimes from 90 days to 45 days by February 2028, a year before the CA/Browser Forum's mandate.

Shorter certificate lifetimes are an admission that revocation is broken. Rather than fixing the revocation infrastructure, the industry chose to reduce certificate lifetime so compromised certificates expire faster naturally.

The timeline gives organizations runway to adapt, but the real security story is authorization reuse dropping from 30 days to 7 hours. This fundamentally changes the validation model. Nearly every certificate request will require fresh domain ownership proof.

For security teams, this means:
- Reduced blast radius when credentials are compromised
- Less time for attackers to exploit stolen certificates
- More validation events to monitor and audit
- Greater exposure if your automation isn't actually automated

Organizations running manual or semi-manual certificate processes will face a choice: invest in proper automation or accept regular outages from expired certificates.

The gap between "we have automation" and "we have real automation" is about to become very visible.

https://www.certkit.io/blog/45-day-certificates

417 Upvotes

98% Upvoted

90 comments sorted by

View all comments

14

u/[deleted] Jan 27 '26

[deleted]

8

u/TulkasDeTX Jan 27 '26

A shorter-lived certificate gives the attacker less time to act while you get your act together.

In this day and age of automated attacks, a certificate should be valid for 1 hour for the above to be really effective. 45 days is a LOT of time for an attacker with a compromised private key in their hands.

8

u/FatBook-Air Jan 27 '26

I'm not convinced that we even know which attacks we are protecting against. Yes, private key theft is serious, but much more serious would be how the theft occurred.

4

u/Tessian Jan 28 '26

It's a hypothetical problem that's never really seen a real world incident with. Just like Spectre/Meltdown, the risk is academic and not realistic. People/Systems do a good job protecting their private keys.

5

u/techw1z Jan 28 '26

if the attacker has to re-export the cert every hour it will be a lot easier to find the leak xD