...that&#x27;s only true while the attacker controls the site.<p>The 90 day window mitigates the effect of the cert being leaked.<p>Just because I grabbed a site&#x27;s cert on day doesn&#x27;t mean I control the site. In fact, there&#x27;s nothing to say I even compromised the site to get the cert in the first place. Perhaps it was mishandled internally? Or grabbed via a heartbleed-style attack?