In addition, domain authorizations last for 10 months, so you don't have to go through the DNS verification each time: just renewing is sufficient. Run the issue command, drop new certs into configuration management, done. Couple minutes tops. Just set your calendar!
Automating this simply means that if someone hacks your machine, they also have full access to generate any certs they like.
I don't consider this a positive thing.
You can separate the generation onto another machine, but it's much more complicated, and the default install is not that way.
I have yet to hear any useful reason to rotate the key.
Well, they can generate certs for your domain. But what exactly is the big difference between generating a new certificate for your domain and having your private key. I fail to see why it would be a huge risk, they can access all your users data in any case.
>I have yet to hear any useful reason to rotate the key. http://security.stackexchange.com/questions/85963/what-is-th...
Basically limiting damage in case of a compromise.
All in, the Lets Encrypt way brings you more security. Since the certificate validity is shorter, even generating an extra certificate will give the attacker a smaller average time with a valid cert than stealing your StartSSL cert.
Another side-effect is that you don't need to manage revocation stuff as diligently, because certificates automatically expire shortly. The window during which a certificate is valid is extremely short and recent, which means there is less chance that a problem happens. when that probability increases (as a result of being older), certificates become automatically invalid.
I use a temporary self-signed keypair, which then gets replaced when the certificate is issued.
For the very first time, you can use let's encrypt's manual verification process, but then have the let's encrypt client set up to renew certs automatically (possibly even from a separate container) using same data file mappings.
I'll take an automated process I run via cronjob and that requires no manual intervention, over a process that requires I touch it once a year.
The decision (to me) is a no-brainer.