Nothing stopping you running your own CA and issuing your own certs. Your actual problem is that the browser vendors (who decide which certs should live in the

Nothing stopping you running your own CA and issuing your own certs. Your actual problem is that the browser vendors (who decide which certs should live in the root store) have certain criteria which CAs need to meet in order to be trusted. Why should Firefox / Chrome / etc. have to honour your desire that your arbitrary-length lifetime certs are trusted by default in their browsers? You still have the personal freedom of installing your own CA root if you like.