[brinox]

Even if your certificate expires after 3 years, the certificate renewal process should be automated. The long validity of 3 years leads many people to not consider this necessary.

If the certificate is only valid for three months however, many people will automate the renewal right away, because nobody wants to do this manually every couple weeks.

From a security POV, shorter lifetimes require more periodic checks for the server's identity. E. g. a Letsencrypt-issued certificate using the ACME protocol will validate the server really belongs to the given domain more often, which is a nice property I think.