Computing, HomeLab, Networking, Software, Software Development, System Maintenance, Technology, Web

Let’s Encrypt Is Cutting Certificate Lifetimes to 64 Days — Here’s Your Homelab Checklist

If you run anything with a public hostname from your homelab — a reverse proxy, a self-hosted app, a NAS admin page, a UniFi controller with a proper cert — this one’s for you.

Let’s Encrypt announced last week that starting February 10, 2027, every certificate it issues or renews will be valid for 64 days instead of 90. This is the first step on a staircase: the CA already laid out a timeline for 45-day certificates in 2028. If your renewals are fully automated, you can probably stop reading after the summary. If anything in your stack renews on a hardcoded schedule, keep going.

What exactly is changing

  • Any certificate issued or renewed on or after February 10, 2027 gets a 64-day lifetime.
  • Existing 90-day certificates keep working until they naturally expire — the last one lapses around May 11, 2027. Let’s Encrypt says no valid certificates will be revoked as part of the transition.
  • Shorter lifetimes are already available as opt-in profiles (45-day and even 6-day), and those are unaffected.
  • The staging environment starts issuing 64-day certificates on October 14, 2026 — so you can test your renewal setup right now, before production changes.
  • ACME endpoints, issuance chains, and rate limits are not changing.

Why they’re doing it

Shorter lifetimes shrink the window during which a compromised or misissued certificate remains trusted, and they make revocation work better in practice because bad certificates simply age out faster. The move aligns with the CA/Browser Forum Baseline Requirements, and according to Let’s Encrypt, every publicly trusted certificate authority will eventually make the same shift.

What it means for your homelab

Here’s the good news: if your renewals are automated and your ACME client supports ACME Renewal Info (ARI), Let’s Encrypt says you’re all set — ARI lets the CA tell your client when to renew rather than having the client guess from the expiration date. Modern Caddy, Traefik, and current certbot-based setups handle this.

The people who need to act are running hardcoded renewal timing: a cron job that renews “30 days before expiry,” a wrapper script with a magic number baked in, a runbook that says “renew at day 60.” Let’s Encrypt’s guidance is to renew at approximately two-thirds of the certificate’s lifetime instead — and to go grep your cron jobs, wrapper scripts, and runbooks for hardcoded values like 83, 80, or 60.

One more thing to watch: the authorization reuse period drops to 10 days next year and all the way to 7 hours in 2028, so anything with a lazy DNS-01 or HTTP-01 validation flow deserves a second look too.

The checklist

  1. Inventory where your certificates come from: reverse proxy, NAS, firewall ACME plugin, UniFi console, all of it.
  2. Confirm ARI support in each ACME client; update the ones that don’t have it.
  3. Hunt down hardcoded renewal intervals and convert them to roughly two-thirds of lifetime.
  4. Test against staging now that it issues 64-day certificates.
  5. Calendar a reminder for the 45-day switch in 2028 — this is a staircase, not a one-time step.

Elsewhere in the homelab this week

  • Unraid and 45HomeLab announced the X4, a 4-bay prebuilt server, alongside the Unraid 7.4.0 beta — where Mover finally preserves hard links.
  • WSL containers (Linux containers on Windows) are now generally available.
  • Gitea skipped ahead in versioning, jumping from v1.27.3 straight to v28.0.0.
  • Nabu Casa (the company behind Home Assistant) is renaming its cloud offering to “Link.”
  • Raspberry Pi raised prices on certain models. Again.

Sources