I was in the same boat, I didn't like having to run python on my server just to renew a SSL certificate. Still, a few months ago I decided to give it a try and I don't regret it. The certbot script is packaged in FreeBSD, it wasn't painful at all to setup and a crontask later it was over. Definitely beats the crappy free "startssl" certificates that I used previously.

There also are a lot of alternative [1] implementations which are less bloated, some are really small with only some hundred lines of code and few dependencies.

[1] https://letsencrypt.org/docs/client-options/

acme.sh runs in pure shell, no need to install Python. It's my goto client and it just works.. everywhere.

https://github.com/Neilpang/acme.sh

Seconded. I love that it supports custom port numbers, so I can use my not privileged web server port.

acme.sh + static verification is indeed a very nice zero maintenance solution.

If you use the DNS verification, you could run the client on your local machine and then upload the cert.

I started writing a small utility to do just that (and then upload the cert to CPanel using their API). It works, though I'm lazy to make it reliable enough for release.

> startssl

I must have at least 4 accounts there due to them using client certificate login. Great proof of concept why certificate based website logins never took off.

you're perfectly free to pay $10/year for a manually issued certificate from one of 50 other providers

And this is what I'm doing right now... :-)

Just hope your certificate provider doesn't screw up or you may be forced to replace early.

https://groups.google.com/a/chromium.org/forum/#!topic/blink...

Why not? There are even docker containers that will do everything for you, all you have to do is tag your application containers:

https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa...

I use Dokku (sort of like an open source Heroku) and the LetsEncrypt plugin. I can deploy a webapp with a git push and have it run over https with no work on my part. Works great.

LetsEncrypt could easily sell extended expirations out-of-band. I see it as nearly inevitable when they need (more) money.

It's unlikely. Google and Mozilla are pushing hard for short-lived certificates, and the CA/B Forum has already passed a ballot that limits certificate lifetimes to 27 months, starting with March 1, 2018. Google wants to see that brought down to 12 months and might enforce that in their own products if the CA/B Forum doesn't keep up.

Pay $10 to disable the cron job running yet another pile of 3rd-party code on a production server, even if it was (eventually) just for a year? I don't see it as a "never!".

The market is probably (a) people who want to support/donate to LetsEncrypt and (b) people who are ultra-paranoid / strongly prefer less moving parts in ops.

The one major downtime I'm aware of so far (a month ago) could also be a factor: Let's Encrypt is down | https://news.ycombinator.com/item?id=14374933

Why not? Automating it once will prevent you from scrambling in three years, which is exactly LetsEncrypt's point.