Upcoming Let’s Encrypt Profile Changes On May 13, 20th, and 27th

API Announcements
1

Let’s Encrypt will be making three previously-announced changes in one week, on May 13, 2026:

  • The tlsserver ACME profile will switch to 45-day certificates. This profile is opt-in, for use by early adopters. The full timeline of shortening our certificates’ lifetime to 45 days over the next two years can be found in our blog post, Decreasing Certificate Lifetimes to 45 Days.
  • The tlsclient ACME profile will only be available to ACME accounts which have previously requested a certificate from that profile. That profile will be available until July 8, 2026. For more details, see Ending TLS Client Authentication Certificate Support.
  • The classic ACME profile will switch to using our new "Generation Y" intermediates. These intermediates chain to our existing X1 and X2 roots, so this change should not introduce compatibility issues.

These changes are live in our staging environment now.

You can learn more about profiles here.

18 Likes
Intended audience for "tlsserver" profile
Generation Y rollout: any ACME profile (or any --preferred-chain combination) still offering the shorter X1-anchored chain?
Certificate Error
Request tlsclient profile access for account 3389924466
Possible expired ISRG Root X2 cert included in chain starting ~May28th?
3

The switch to Generation Y intermediaries announced here will be delayed.

10 Likes
4

The first two points from this change are now deployed: tlsserver is issuing 45-day certificates, and the tlsclient profile is allowlisted to accounts which had previously used it.

The switch to issuing using intermediates in our Y hierarchy has been delayed at least one more weeks while we evaluate the impact of our recent re-issuance of the cross-signed CA certificates. We'll provide an updated timeline before making that change.

9 Likes
Upcoming Let’s Encrypt Profile Changes On May 13, 20th, and 27th
5

In our recent incident, 2026.05.08 Gen Y Cross-Certified Subordinate CAs missing serverAuth EKU, we identified a problem with our cross-signed CA certificates. To minimize any potential for disruption, we delayed switching the classic profile to the Y hierarchy and switched our tlsserver and shortlived profiles back to our previous intermediates. We have issued new cross-signed certificates which contain corrected Extended Key Usage fields, and are prepared to move forward.

Today, we will be switching tlserver and shortlived profiles to the intermediates YE1, YE2, YR1, YR2. We will switch the classic profile to these new intermediates in one week from now, on 2026-05-27.

15 Likes
7

This change is now complete.

10 Likes