> It would be nicer if certs could be issued with long lives but required a stapled revalidation with a short time span (daily? weekly?), which would be automat

> It would be nicer if certs could be issued with long lives but required a stapled revalidation with a short time span (daily? weekly?), which would be automatically issued at any time requested unless the certificate was revoked. That's called OCSP Must-Staple: see https://en.wikipedia.org/wiki/OCSP_stapling https://en.wikipedia.org/wiki/OCSP_stapling, https://github.com/acmesh-official/acme.sh/blob/d437d6fde95dc7368d4fa76c05648a8dd4cbe69e/acme.sh#L6270 https://github.com/acmesh-official/acme.sh/blob/d437d6fde95d..., https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#35-use-ocsp-stapling https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deploym...