That philosophy is perplexing because system admins already have to manually handle things like software upgrades.  Unlike SSL renewals, upgrades usually occur to an arbitrary frequency yet admins seem to be able to cope.<p>I&#x27;d also contend that 90 day expiry makes end-users less sensitive to certificate change notifications; at present if a website renews its cert after a year I receive a pop-up and I pay attention.  Receiving one every 60 days will just condition people to start ignoring cert changes, whether valid or not.