Reasons for short lifetimes: * there is no robust revocation mechanism, so just minimizing the validity of a compromised cert is the most effective - and techn

Reasons for short lifetimes: * there is no robust revocation mechanism, so just minimizing the validity of a compromised cert is the most effective - and technically simple - tool. OCSP is not viable for myriad reasons discussed over the years. OCSP stapling is optional and browsers have to consider it such explicit (opt in) policies. * extended lifetime means rolling certificates is a complex ceremony that means rapid response is off the table, and can take companies days if not weeks to do. * following from that: long lived certs also breaks distrust of CAs as they (or site owners) return with “we can’t perform the task we agreed to because we’ll break our customers” (CAs often fail to understand that their primary customers are end users not site owners).