Pros and cons of 90-day certificate lifetimes

The only worry I have with 90day certs and an automated process in the current implementation is that LetsEncrypt can (and has) changed the keys/authorities between signing events – and that can have compatibility issues.

If the keys/authorities change, and are not guaranteed to be 100% backwards compatible (in terms of os/browser/etc support), that is a huge worry. I would not like to find out that certs are no longer trusted on certain platforms from angry users or broken applications. I would also not like to see issues where things break because of cached certs (like in here IIS 8.5 building incorrect chain with Lets Encrypt Authority X3)

If there were a commitment to backwards compatibility (perhaps there is), or an option to peg the preferred authority for a grace period on renewals, that would probably address this concern.

With advance notice and timing, this sort of thing isn’t an issue – but in the current implementation, a lot of variables can change with little or no notice.