1a. You can't control what root/intermediate will be used by your certificate supplier one year from now. 1b. You should not reuse private keys between certif

1a. You can't control what root/intermediate will be used by your certificate supplier one year from now. 1b. You should not reuse private keys between certificates and never for intermediate or root. 2. It's yearly or 2 years for the most common suppliers. 3. Have fun getting your certificate accepted from every device and operating system. Anyway. I am not saying that it can't be done, I'm saying that there are a lot of challenges to doing it properly and any mistake will make the app completely broken.