NOTE: All these answers assume you're talking about CERTIFICATES FOR THE WEB (WebPKI). (Not for code signing, e-mail, etc.) Please let me know if this is indeed what you wanted to know.
Now in case you were NOT talking about WebPKI, you may want to take a look at the respective CA's "Certification Practice Statements" (CPS).
Example: Digicert's CPS lists their validity periods here:
The longer, the more expensive. See for example: https://www.digicert.com/buy-ssl-certificates/ (Archived here: https://archive.is/G5D9p)
Yes. See above.
Not sure. I don't think so.
They're pretty much all bound to the BASELINE REQUIREMENTS for the regular kind of certs, which are DV (domain validated) certs.
And the BRs currently define a limit of 3 years + 3 months. (39 months)
But this will change next year. Then the limit will be 2 years + 3 months. (825 days to be precise.)
Nice blog about this change is here: https://www.entrustdatacard.com/blog/2017/march/maximum-certificate-lifetime-drops-to-825-days-in-2018 (Archived here: https://archive.is/JCa2M)
Now for EV (extended validation) certs the rules are laid out here:
And they have this to say:
9.4. Maximum Validity Period For EV Certificate
The validity period for an EV Certificate SHALL NOT exceed 825 days. It is RECOMMENDED that EV Subscriber
Certificates have a maximum validity period of twelve months.
-- To be honest I have no idea at all what kind of weight a statement like "It is RECOMMENDED" carries. (I'm genuinely interested. Does anybody care about such a recommendation? Are there soft sanctions, like being frowned upon or something? -- Please leave a comment if you know more.)
But take the Digicert link from above: they currently do offer 2 year EV certs. (In spite of the recommendation.)
Yes. You pay more, you get longer validity. (Up to the limit mentioned above.)