Let's encrypt certificates are valid for only 90 days, and I guess the argument is that you want automatic tooling to take care of renewal if it happens so often.

That might actually be a good thing, though. Currently I have to do it for a couple of domains every year. By forcing me to automate it, it takes me more time once, but afterwards I don't have to look at it anymore at all.

Ugh, really? I was planning on only using the tools to write out the initial certificate file, as I don't want too much running on my servers. This has certainly put a damper on my excitement about Let's Encrypt.

From a quick look at the protocol, it shouldn't be an issue to run the ACME client on one host and scp CSRs from your servers to it, hand them to lets encrypt, and move the results back. So yes, you have to touch or run it every 2-3 months, but it doesn't have to run on all your servers.

I'm more wondering if I can cron it (without sudo), and not have it run as a daemon. Then, once every two weeks or so, it can just refresh the cert using the csr I generated before. It should be pretty easy to do, I'm just not familiar with the clients at this point.