&gt; a 90 day window of cert validity limits the amount of time a given cert can be out in the wild, impersonating your site.<p>But a the OP pointed-out, if a site using LE is compromised then the attacker has basically an infinite duration of valid certs, because they are automatically renewed.<p>There is no manual challenge to receive a new cert.  So essentially the validity period of an LE cert means nothing.