Let’s Encrypt Unveils new “Generation Y” root and to 45 day certificates

**Executive Summary:** Let's Encrypt announced a Generation Y root and intermediate CA hierarchy (cross-signed by the existing Generation X roots), the planned deprecation of TLS client authentication, and a phased reduction in certificate lifetimes—introducing short-lived certificates with IP support now and scheduling 45-day and 64-day defaults across 2026–2028—with profile-specific rollout dates and an option to remain on the legacy tlsclient profile until February 2026.