The best practice is to fully automate certificate provisioning. Short lived certs force this behavior. The private key should also be minimally exposed so don’

The best practice is to fully automate certificate provisioning. Short lived certs force this behavior. The private key should also be minimally exposed so don’t create a bucket of private keys waiting around for some future use. Keep copies to a minimum. The other idea behind short lived certificates is that revocation doesn’t really work. It doesn’t scale, it’s handled poorly by clients, and half the time you don’t even know your cert has been compromised in order to decide to revoke it. Expiration is the only fool-proof way to revoke a cert.