11 Oct 2026 · security, infrastructure, redes · 4 min
The free certificate that became web infrastructure shrinks to 64 days
Eight of the ten large sites I measured today serve a certificate with less than 91 days of validity. The longest in the sample runs 198 days, and it is one of the two that comes from a paid authority.
A 90 day average makes sense: that has been the Let’s Encrypt default since 2015. On February 10, 2027 that default drops to 64 days, with 45 and 6 day profiles available to anyone who wants them. The announcement is on their blog, and the last 90 day certificate they issue expires on May 11, 2027.
What this entity actually is
Let’s Encrypt is a nonprofit certificate authority, run by the Internet Security Research Group. ISRG was formed in November 2014 with support from the Electronic Frontier Foundation, Mozilla, the University of Michigan, Akamai and Cisco, and the pitch was easy to say and expensive to build: hand out certificates for free, over an open protocol, with nobody clicking through a browser.
Before that, HTTPS was a line item. You bought a certificate per year, pasted the file on the server, and repeated the ritual at every expiry. The result was predictable: small sites and sites without a team stayed on HTTP, and the padlock became a company logo. Today it is the world’s largest certificate authority, used by more than 700 million websites, according to Wikipedia.
Free against paid, measured
I took ten busy domains and read the certificate each one serves today with openssl s_client, looking at issuer, validity, key type and signature algorithm.
| site | validity | issuer | key |
|---|---|---|---|
| cloudflare.com | 90 days | Google Trust Services | ECDSA P-256 |
| wikipedia.org | 89 days | Let’s Encrypt | ECDSA P-256 |
| news.ycombinator.com | 89 days | Let’s Encrypt | ECDSA P-256 |
| letsencrypt.org | 89 days | Let’s Encrypt | ECDSA P-256 |
| github.com | 89 days | Sectigo | ECDSA P-256 |
| apple.com | 84 days | Apple Public EV | ECDSA P-256 |
| google.com | 83 days | Google Trust Services | ECDSA P-256 |
| mozilla.org | 90 days | Google Trust Services | RSA 2048 |
| duckduckgo.com | 198 days | DigiCert | RSA 2048 |
| amazon.com | 197 days | GeoTrust | RSA 2048 |
Free loses nothing technical. A 256 bit elliptic curve key and a modern signature show up on both sides of the table, and the cryptographic difference between a free certificate and a paid domain-validated one is zero. What the paid side still sells is a longer window, support and a warranty.
That window is closing from above. A CA/Browser Forum vote, SC081v3, carried with Apple, Google, Microsoft and Mozilla voting yes, cuts the maximum validity from 398 days to 47 days between March 2026 and March 2029. Those 197 and 198 day certificates in my sample sit exactly at the 200 day ceiling that was already in force when I measured. The room paid certificates had to exist in is being closed by the browsers that govern them.
The arithmetic that changes
| validity | renewals per year |
|---|---|
| 90 days | 4.06 |
| 64 days | 5.70 |
| 45 days | 8.11 |
| 6 days | 60.83 |
Four renewals a year become six. That sounds small, and that is where the problem lives: automated renewal is a process someone configured once and forgot. The 6 day certificate, sixty renewals a year, only exists on top of real automation.
Let’s Encrypt points the way. If your job renews by counting days until expiry, move it to roughly two thirds of the certificate lifetime, and go looking for the hardcoded numbers that show up in cron jobs, scripts and runbooks: 83, 80, 60. The domain authorization reuse period drops from 30 days to 10, and in 2028 to seven hours. Anyone using ACME Renewal Info has nothing to change, because the client stops deciding when to renew.
The check takes a second against any domain:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -dates -issuer
What I would do with that output is boring on purpose. One daily check, one alert when seven days remain, and a forced renewal once to see what failure looks like. A certificate is one of the few things that breaks in the visitor’s face, in red, which is exactly why it deserves the dumbest monitoring you can build.
A caveat: ten domains, one day, a snapshot. Private authorities keep their own schedules, as the 197 day entry shows.
My read is that the shrinkage is the right call and the worry is honest. A 64 day window limits the damage from a leaked key and pushes the risk onto automation, which is the part nobody tests. A site that already sits behind an edge issuing its own certificate will barely notice, and that is a second lesson about how TLS service disappears when it works. The first lesson is the one that shows up when a piece of essential infrastructure changes hands: free infrastructure is still infrastructure, and it changes when the people paying for it change their minds.