Re:Forthcoming OpenSSL releases
by iancarroll on Monday July 06, 2015 @07:53PM
(#9842851)
Some allow manually specifying the expiration times.
Entrust, for instance, allows you to purchase certs essentially on a subscription plan. You may have one valid cert for 3 years (and pay the reduced 3 year rate), and reissue it with 24 hour expirations every day.
I personally wouldn't go with an expiration that low because of the operational overhead, but a few weeks or a month is attractive. It still significantly limits the downside potential versus 1-3 year certs. Basically any cert (non-root) over 1 year should be considered against best practice at this point.
I think they reissue the same 1y+ validity cert...