[klaas-]

I think a very short lived cert (like 7 days) could be a problem on renewal errors/failures that don't self correct but need manual intervention.

What will let's encrypt be like with 7day certs? Will it renew them every day(6 day reaction time), or every 3 days (4 days reaction time). Not every org is suited with 24/7 staffing, some people go on holidays, some public holidays extend to long weekends etc :). I would argue that it would be a good idea to give people a full week to react to renewal problems. That seems impossible for short lived certs.

[iqandjoke]

Like Apple case. Apple already ask their developer to re-sign the app every 7 days. It should not be the problem.

[kassner]

That’s only a thing if you are not publishing on Apple Store, no?

[dcow]

Correct. Or if you’re not using an enterprise distribution cert.