> Any certificate being used on the public web today which has an expiry date more than 3 years in the future will not be able to live out its full life. Why n

> Any certificate being used on the public web today which has an expiry date more than 3 years in the future will not be able to live out its full life. Why not have a later cut-off for certificates that were issued before, say, 1st January 2014? That way the CAs after January will know not to sign SHA-1 based certificates which will expire in or after 2016, but current long-life certificates (which aren't selfies anyway) will still be OK Also, microsoft.com seems to be using a certificate which uses MD5...