Certificate expiry

Website certificates are deliberately given a short life and have to be replaced regularly. The industry keeps shortening how long they last.

The reason is that there is no dependable way to cancel one early. If a certificate is stolen, telling every browser in the world to stop trusting it is unreliable, so the practical limit on the damage is how soon it expires by itself. Shorter lives mean less exposure, and they also force renewal to be automated, because anything a person has to remember to do once a year is something that will eventually be forgotten at three in the morning.