Let's Encrypt moves to 64-day certificates in February, and renewal maths has to move with it
From 10 February 2027 Let's Encrypt issues 64-day certificates by default, with the last 90-day certificate expiring on 11 May 2027 and no revocation of what is already out there. Clients that follow ACME Renewal Info handle it; hard-coded offsets need to move to about two thirds of the lifetime, and a third-party test in October found one acme.sh version scheduling its renewal after the certificate had already expired.