The $$ CAs will soon only issue 45-day certs, because that's all that browsers will accept.