Best practice is Let's Encrypt 3 month certs and best practice is to only allow TLS cipher suites that provide PFS (which are the only ones allowed for HTTP/2 a

Best practice is Let's Encrypt 3 month certs and best practice is to only allow TLS cipher suites that provide PFS (which are the only ones allowed for HTTP/2 and the only ones present in TLS1.3), which mean that the private key for the cert is useless as soon as the cert expires and cannot be used for retroactive decryption even while the cert is valid.