I was looking at the certificate behind https://www.google.co.uk/ earlier and noticed that, as is typical, the certificate was set to expire after a year, by 2013.
I looked up the chain and notices that the root cert, a GeoTrust cert, has a 20 year lifetime and doesn’t expire until 2018.
It seems odd as the integrity of signing certificates seem to me more important than the certificates they sign. Why is it OK for root authorities to live for a long time but the certificates they sign tend to have much shorted expiry times?
The private key of a root signing certificate will generally be better protected than that of a server certificate. Typically individual server certificates will be stored on the web server in question unencrypted, so the server can come back up after a reboot without human intervention. But a signing key will be kept more securely, typically passphrase protected and not on an internet-facing server, since if the signing key is compromised all certificates it issued become worthless.
The use of short expiry times for certificates with less-well-protected private keys is basically a damage limitation mechanism in case the private key is compromised.