What should the default cert validity duration be?

[maxsmythe]

Different organizations may have different views of the best setting. What's a good one-size-fits-all value?

We should discuss this once all the other work in this milestone is complete.

[gparvin]

Make it configurable, but other defaults are:

• cert-manager and let's encrypt: 90 days
• publicly trusted certs now have a 13 month max
• OpenShift service signing service: 2 years