Short TLS certificate lifetimes mean that the CA checks to ensure the certificate owner actually controls the DNS once every 3 months, so it's less likely someone will have a certificate for a domain they only had control of for a temporary period.
And I think the rationale is also to force people to automate the process which is a good thing.
I don't understand this sentiment. Once the process is automatic it won't be managed or monitored.
Well, even large companies do a crap job at managing and monitoring the renewal of certificates manually. There has been many occurences of large companies (including Microsoft or Linkedin) leaving some certificate expire.
Right and I don't expect them to manage an automatic process any better. I'm saying that there should be a form of trust for long standing stable environments.
You don't need to control the domain (only for wildcards), ability to serve under .well-known is enough.