This doesn't really work without the certificate expiration date also being 24-48h in the future, though.

I think they reissue the same 1y+ validity cert...

Some allow manually specifying the expiration times.

Entrust, for instance, allows you to purchase certs essentially on a subscription plan. You may have one valid cert for 3 years (and pay the reduced 3 year rate), and reissue it with 24 hour expirations every day.

I personally wouldn't go with an expiration that low because of the operational overhead, but a few weeks or a month is attractive. It still significantly limits the downside potential versus 1-3 year certs. Basically any cert (non-root) over 1 year should be considered against best practice at this point.

> It makes public key pinning hard (impossible?), though.

In this case you don't pin the server's key but the "central" key.