Shorter Let's Encrypt certificate lifetimes: what does it mean for you?

Let's Encrypt is the free certificate authority used by most websites, including at WebOké. A Let's Encrypt certificate is currently valid for 90 days. That is getting shorter, and Let's Encrypt has already stopped sending reminder emails when a certificate is about to expire. Here you can read what is changing and what you need to do.

What is changing

A successful validation of your domain name is also remembered for a shorter time: from February 2027 for ten days, and from February 2028 for only seven hours. You will mainly notice this if you request a certificate manually using a DNS record, because you will have to repeat that step more often.

With this change, Let's Encrypt follows the rules of the CA/Browser Forum, which apply to all certificate authorities. A certificate with a shorter lifetime limits the damage if something goes wrong, such as a leaked key. What this means for you: renewing manually is no longer an option. It has to happen automatically, and you need to keep an eye on whether it succeeds.

On your hosting package: nothing to do

With a hosting package, DirectAdmin requests the certificate and renews it automatically. You don't need to change anything for that. Your domain does need to keep pointing to our server, because Let's Encrypt checks this again on every renewal. See Activating and renewing an SSL certificate and troubleshooting problems.

You can see how long your certificate is valid with Domain health. If it expires within 14 days, it will report that renewal is falling behind. In that case, check under SSL Certificates in DirectAdmin whether any validations have failed.

Do you also use a certificate outside your package, for example because you copy it manually to another device or service? Then you will soon have to do that every few weeks. It's better to let that device or service request its own certificate.

On a VPS: set it up and check it yourself

On a VPS, you handle renewal yourself, using certbot, Caddy or the ACME client of your software. See nginx with a Let's Encrypt certificate and Caddy: a website with automatic https. With certbot, check the following:

1. Check whether the renewal timer exists and is running:

   systemctl list-timers 'certbot*'

2. Do a test renewal. It does not request a real certificate:

   sudo certbot renew --dry-run

   If it ends with a message that all simulations succeeded, renewal is working.
3. Does your web server actually load the new certificate? With the nginx plugin, certbot takes care of this itself. If you use certbot certonly, set up a deploy hook that reloads your web server.
4. Keep your ACME client up to date through the package repository. Let's Encrypt recommends ARI (ACME Renewal Information): with it, Let's Encrypt itself tells you when a certificate should be renewed.

Have you created your own script or cron line that renews every 60 days, for example? That will fail as soon as certificates have a shorter lifetime. Let the client decide when it's time, and have it check at least once a day.

You manage the VPS and everything running on it yourself. We help with the WebOké part: the panel, the network and snapshots.

Monitor the expiry date

Because there are no more reminder emails, Let's Encrypt itself recommends monitoring whether renewal succeeds. A monitoring service that reads your certificate's expiry date and warns you when fewer than 14 days remain will catch a silently failed renewal in time. See Monitoring your website: availability, certificate and domain.

Further reading

• Decreasing Certificate Lifetimes to 45 Days (Let's Encrypt, English)
• Expiration Notification Service Has Ended (Let's Encrypt, English)

Want to learn more? Take the free course VPS and Linux server management, lesson 7.3 https with Let's Encrypt.