I don't know if this has been covered in one of the other threads (no obvious searches showed it up): As an attacker, why would you choose to limit the valid-u

I don't know if this has been covered in one of the other threads (no obvious searches showed it up): As an attacker, why would you choose to limit the valid-until date on certificates you generate to a very small value? You might expect people to notice they're being MitM'd fairly fast, and the breach to be uncovered and your certs distrusted quickly, but that's not really a good reason to deliberately limit yourself. The only sensible answer I can think of is that maybe there is some internal auditing that generating very short-duration certificates gets around? Anyone got any better ideas?