Why is your LE broken? 'because 1 of the 12 automated renewals last 3 years (to compare vs 3 year paid certificate at 4 euro) failed for reason X, Y or Z'. Be it them being down, be it your uplink being down, be it your dns malfunctioning, be it another massive spamhaus-sized-internet-disrupting-ddos. There are plenty of ways a LE renewal can go wrong, and having this 'chance' occur 4 times a year, i find bad practice.

Just because something is free, doesn't make it better. And having 12x more points in same timeframe where the automated renewal can fail, certainly doesn't make it better statistically.

Also i grew up with the notion, 'nothing in the world is free, except the sun'. So i wouldn't be surprised if they will start to monetise this LE user base at some point in time.

> Be it them being down, be it your uplink being down, be it your dns malfunctioning, be it another massive spamhaus-sized-internet-disrupting-ddos.

I have my certbot set to run once a week with --keep-until-expiring, so it will try to issue a new certificate when the old one's remaining validity is less than a month. I could also set it to run daily, because it doesn't actually do anything if the cert is still valid for long enough. But a week works on my (admittedly small) scale.

So unless you're experiencing a multi-week DNS malfunction or multi-week DDoS (in which case you're in some deep shit anyway), you should be fine.

So you prefer to have something (which most people have ) with root privileges to pull data unattended, 52 times a year, from some 3rd party host via python then to manually do (if you wanted ONLY once in 3 years) something once a year manually?

Is this really what i am reading?

Certbot isn't the only acme client in town. I use Chef personally: https://github.com/schubergphilis/chef-acme/

Professionally, it's not once every three years, it's that x the number of clients we host. Which is a lot. Many are clamoring for LE, because it's within their budget: $0. So yea, I want to automate that.

I have another cronjob that fits the same description, runs daily, and it's called "unattended security updates". Just saying.

Edit: Also, it's a persistent myth that certbot needs to run as root. It most certainly doesn't on my servers.

> There are plenty of ways a LE renewal can go wrong, and having this 'chance' occur 4 times a year, i find bad practice.

Fortunately, we can also discard some of the high stakes gambles we take to avoid cert costs. Your cert lives for 90 days. Why wait until day 89 to renew? It's certainly not to avoid the expense. The LE defaults renew at day 70. That gives you 20 days for transient failures to resolve themselves, so that's a concern you can dismiss out of hand. And if you don't think that's enough time for ops team to work out whatever problem they have, you can configure your tooling to renew sooner.

Yes, renewals every 70 days introduces a 5th renewal every year, but IMO the hardest and most important renewal is the first one, and you might as well take it sooner than later.

TANASTAAFL is a thing, but even if the only lasting impact LE has is to arm-twist CAs into a commonly accepted API, that's still a win in my books for competition and near-frictionless competition. Anyone seen the Comodo API? And how it compares to the Symantec API?