Interestingly - StartCom's free certs used to only have 1yr validity - one I got last week is good for 3 years. Cynical-me suspects they're doing that to improve their chances of sitting out a limited 1yr timeout. It'd be almost indistinguishable from a death penalty if all their existing client certs expired while they were unable to renew them - I wonder how long they've been signing certs for 3yrs instead of 1?

But that's why browsers are increasingly requiring CAs to implement https://en.wikipedia.org/wiki/Certificate_Transparency