From another post, from Digicert, it looks like that my suspicion is confirmed: Prior to this proposal by Apple, Google promoted a 90-day maximum lifetime,

From another post, from Digicert, it looks like that my suspicion is confirmed: Prior to this proposal by Apple, Google promoted a 90-day maximum lifetime, but they voted in favor of Apple’s proposal almost immediately after the voting period began. https://news.ycombinator.com/item?id=43693900 https://news.ycombinator.com/item?id=43693900 To be noted that this doesn't just affect certificate generation, but also things like when you have a pool of subcertificates from a given certificate, that will all have to be regenerated and deployed as frequently in cascada, and also, like when you have server or clients or a specific device that validate specific certificates. Their only viable solution would be to accept widely any certificate from one of the big top level "trust" CAs...