> Are root cert keys not rotated? They are but by their nature as core components of OS and devices they have to be long-lived, because they “bound” the lifeti

> Are root cert keys not rotated? They are but by their nature as core components of OS and devices they have to be long-lived, because they “bound” the lifetime of their sub-certs. So root-certificates usually have an expiry of a decade or two, intermediate certs a few years (about 5), and then leaf certificate lifespans have been cut down drastically: used to be you could get a 10 years cert, then the CABF cut that down to 5, then 3, then 2, and I think now it’s a year (plus a one month grace period, so 13 months), and some registrars issue much shorter certs than that, notably Let’s Encrypt which issues 90 days certificates and basically requires automation.