A Note from Our Executive Director

Yeah, the "just use something like Caddy" is the main issue. Most software and especially most hardware appliances aren't that progressive yet.

A big part of the reason why shorter cert validity is desirable is because CAs routinely violate the mandatory revocation deadline, usually with an argument which boils down to "$BigOrg doesn't want to". And they don't want to because they have developed an extremely complicated manual process around certificate renewal, sometimes requiring weeks from end to end.

Luckily most of the cert issues are primarily administrative, but it does show what the PKI infrastructure will most likely be unable to timely respond to an incident with real-world consequences. The major browsers are already planning to reduce the validity of all certificates to 90 days or even less, and LetsEncrypt serves a nice role by showing everyone that high-frequency renewal is indeed possible. After all, if a nonprofit can do it surely a well-paid CA wouldn't have any issues with it?

By normalizing short certificate lifetimes they are essentially forcing the industry to innovate. Either make sure everything using certs has an API which allows for automatic renewal, or stop using the public PKI infrastructure and run your own private CA.

I could see that value being chosen so people have no incentive to game the cert expiry. For whatever peace of mind it gives them to rotate certs only at low traffic times of the week.

If you have a 7 day expiration, some sysadmin is going to set up the renewal check on a weekly cron job. When the cert renewal fails, they don't have any time to act. 6 day expiration = you run the check daily. If something fails to renew, you might have a little more notice.