There is no way to reliably revoke certificates. Therefore it's crucial to keep a short expiry limit.

90 days isn't short, it's about 89 days too long.