Good idea, let's change that slightly. Require a new cert to be available at a standard path, not less than 10 days before the previous expiration date for ord

Good idea, let's change that slightly. Require a new cert to be available at a standard path, not less than 10 days before the previous expiration date for ordinary websites, and not less than 1 year before the previous expiration date for long-lived certs. Then part of the standard utilities in any SSL library should be the autoupdater, which recognizes that a cert should have an update available and takes care of that, emitting loud warnings if the replacement is not available in the appropriate window.