Sometimes it comes down to whether user-generated content with externally linked resources is allowed on the site. E.g. forums often allows embedding images by users and because users don't care about HTTP or HTTPS and only copy the image link from somewhere, you will end up with "mixed content" warnings and broken "locks" in the browser address bar all over the place.

The current alternative is to simply use HTTP, which doesn't yield any warnings. When Chrome will mark all non-HTTPS sites as insecure this will change, hopefully.

This is a very good point, but as you say and the article states, the lack of warnings for this is changing.

There's also the obvious question of having user login/signup on a non-HTTPS site in the first place (pseudo-anonymous user accounts or otherwise).

certbot has failed continually on my DO instance. It cannot update my cert on cron. I have to manually update my cert when I remember to do so. In fact, I had forgotten to do this for the last several months, so my site gets to display a nice scary warning for anyone who might venture forth and try https. I've searched how to fix it and nothing comes up. The site is static html and I've considered just removing https.

What are the contents of your crontab? Anything in the certbot logs?

What server software are you running?

I use a cheap shared web host. My current and previous host both have LetsEncrypt implementations that take a couple of clicks. The former one was just default cpanel I think.

It is difficult if you want to understand the process, though no more so than, say, using Git IMO.

In short cpanel and other shared host panels make it as easy as the clicky-clicky Wordpress install

> It is difficult if you want to understand the process, though no more so than, say, using Git IMO.

Given how arcane and confusing anything beyond the most basic Git usage can get, that's hardly a glowing endorsement. :)

I agree, I found that comparison a bit odd. Certbot is many many orders of magnitude easier to use than Git, and that's even if you need to "use" it beyond the run-once-and-forget standard use-case

>but what exactly is complicated about setting up certs for a dev?

Seeing as how he mentioned AWS, it's a bit more complicated if you have a cluster of servers that are automatically managed. You have to set up a reverse proxy and integrate that into your cloud provider's workflow.

> what exactly is complicated about setting up certs for a dev?

it may not be complicated but you cannot beat doing nothing.