If you have a 7 day expiration, some sysadmin is going to set up the renewal check on a weekly cron job. When the cert renewal fails, they don't have any time to act. 6 day expiration = you run the check daily. If something fails to renew, you might have a little more notice.