Brighter Bytes - October 2026 Newsletter

On February 10, 2027, all Let’s Encrypt subscribers will move to certificates with 64-day lifetimes by default unless they select an even shorter lifetime (45 or 6 days, as previously announced). This means that any certificate we issue or renew on and after that date will have a 64-day validity period, and we expect the last 90-day certificate to expire on May 11, 2027. We will not revoke valid certificates as a part of this process.

You can start testing in our staging environment. Give it a try!

Continue reading the full blog post to learn more.

Let's Encrypt is adding two new remote perspectives for domain validation. This change is motivated by the fact that increased perspectives provide more domain validation security and is required by the Baseline Requirements. Increasing the number and coverage of our domain validation perspectives improves visibility and protection against BGP attacks.

During domain validation, this means that we will make seven total validation requests, one from the primary datacenter and six from remote perspectives (previously four). For validation to succeed, the primary server and a quorum of remote perspectives must receive the correct challenge response. This makes it more difficult for attackers to hijack validation requests. To learn more about multi-perspective domain validation, please see our earlier blog post when Let's Encrypt first added new perspectives.

We expect little to no impact on users. Let's Encrypt began performing domain validation with the new regions in staging on Tuesday, October 27th, 2026. Assuming all goes well, we will rollout to production on Tuesday, November 10th, 2026.

Please post any questions on the Community Forum.

The Rustls TLS library is now 10 years old! We are thrilled with the project’s growth and development during that time. Today, Rustls is a highly performant and memory-safe library that is used in production around the world. Two of the project’s maintainers, Joe Birr-Pixton and Daniel McCarney, recently reflected on this milestone.

Check out their talk at RustConf 26.

Google and Cloudflare have set a goal of moving to post-quantum cryptography by 2029, which is sooner than the industry expected. That’s a strong signal that it’s time to prepare for quantum computers capable of breaking today’s encryption. In a new post, Divvi Up engineer Tim Geoghegan explains how we're getting ready. The cryptography Divvi Up uses to keep each person’s data private was already secure against quantum computers. The remaining work was in how that data is protected as it travels across the Internet. Divvi Up’s production systems now support post-quantum protections, and updated client libraries are on the way. Older clients will keep working, so users can upgrade at their own pace.

Continue reading the full blog post to learn more.

We’re grateful to DuckDuckGo for supporting ISRG again this year with a $30,000 gift through its 2026 Charitable Donations Program.

We’re proud to be named alongside so many organizations that share our goal of a more secure and trustworthy Internet. Support like this helps our three projects, Let’s Encrypt, Prossimo and Divvi Up, improve the security and privacy of billions of people using the Internet every day.

A Good Day for Cryptography

October 16 was a good day for the cryptography community.

A 25-year-old question about the math behind some of the Internet’s most widely used encryption was finally answered. The answer revealed a lost method used to create the widely-used NIST elliptical curves.

In 2023, Filippo Valsorda created a bounty to settle the question, with a twist: if the solvers gave the prize to a nonprofit, it would be tripled. A group of engineers chipped in to fund it. And when a team of researchers at Anthropic solved it, they chose to donate the $36,864 prize to ISRG. We’re thrilled!

Thank you to everyone who created, funded, and solved this bounty!

Read our blog post to learn more about this fun story that strengthens the public’s trust of our cryptographic infrastructure.

We are excited to share that nic.br has joined our sponsor community. The Brazilian Network Information Center is a nonprofit that keeps Brazil’s Internet running and operates the .br domain registry.

Join our Global Community of Sponsors

Our new 2027 Sponsorship Prospectus is hot off the press. Check out our expanded sponsor offerings for 2027 including sponsor-only technical briefings. If you may be interested in having your company sponsor us, please reach out!
Speaking of a global community, we recently attended the Open Source Summit Europe in Prague. It was a wonderful opportunity to connect with new and longtime sponsors, users of Let’s Encrypt, and friends of encryption. We don’t have many of these opportunities to meet folks in person throughout the year so we value them!

Next up will be FOSDEM January 30-31, 2027. We’d love to say hello to you there.