Comment by hulitu

> I think keeping the validity long just removes incentives for people to bother fixing their setups.

The best certificates should expire after 20ms. /s