On February 10, 2027 Let's Encrypt shortens its standard certificate lifespan from 90 days to 64. Authorization reuse shrinks from 30 days to 10. One year later it reduces further to 45 days and 7 hours. There is no way to opt out and no profile that maintains 90 days. Staging already changed on October 14, 2026.

Here is the difficult aspect. cert-manager serves as the standard TLS issuer for most Kubernetes clusters, and right now its documentation and announcements mention nothing regarding the change. Its support for ACME Renewal Information, the method Let's Encrypt states you ought to use, launched in July 2026 as an alpha feature gate disabled by default, and prior to October 23 it possessed a bug that generated five certificates in ten seconds before triggering the rate limit.

Most clusters will survive February without issue, by chance. The standard renewal calculation naturally scales with whatever lifetime the CA provides.…