If it really was only to make money for CAs we'd see LetsEncrypt offering very long lifetime certs. But: * Very short lifetimes get people to automate, prevent

If it really was only to make money for CAs we'd see LetsEncrypt offering very long lifetime certs. But: * Very short lifetimes get people to automate, preventing problems where one cert lasts long enough to lose the institutional knowledge around it. * CRLs don't work. For performance you don't want to check for a revocation in serial with the request, and you don't want to block all browsing if the revocation list server is down. Revoking a cert will cover some users, but lots will still get "https://" https://" and no warnings.