Why the intermediate jump to 64 day certs, why not go directly to 45 day certs?
Considering Let’s Encrypt will have no issue staying compliant with SC-081v3 requirements until 15 March 2027 unlike other CAs which need to shorten their cert lifetimes a year earlier.
LE expressed concern that there are ACME Clients that renew after 60 days. This interim step allows them more time. Sure, we can argue the "shoulds" but ... By 2028 when LE switch Classic to 45 days this should be little surprise and not cause unintended outages due to expired certs. Hopefully before then people have switched to using an ACME Client that supports ARI 
From their blog post: Decreasing Certificate Lifetimes to 45 Days - Let's Encrypt
If your client doesn’t support ARI yet, ensure it runs on a schedule that is compatible with 45-day certificates. For example, renewing at a hardcoded interval of 60 days will no longer be sufficient. Acceptable behavior includes renewing certificates at approximately two thirds of the way through the current certificate’s lifetime.
Yep, that's exactly it. We're aware of a number of clients that renew every 60 days, rather than renewing a certain percentage of the way through the certificate lifetime (or better yet, following ARI). Reducing directly to 45 days would break those clients, which we'd like to avoid. Reducing to 64 days will hopefully generate enough impending expiration warnings, or enough general press, for those site operators to become aware of the change and update their ACME clients.
didn't you guys no longer sending expiry mail? not sure anything short of scream test (make it expire) will cause them to notice as it'd been automated away. we'd have statistics about how client's schedule was set (keep ARI/renew before 30 days of expiry / renew after 60 days)
Correct, we no longer send expiration warning emails ourselves. However, there are many other expiration notification systems, including local monitoring, which may trigger.
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.