Given that certificate issuance is the most vulnerable part of the process (DNS hijacking during the validation process), isn't it a bad idea to encourage renewing certificates so often?

Plus, this is yet another blow to using TLS for networks not connected to the Internet. Asking users to go through some pain of accepting a new self-signed cert every three months, which was already worse than once a year, is going to get almost untenable at 45 days. And no one is offering any realistic alternatives.