What about an internal machine, with no outside [incoming] connectivity? But you don't want to install your own self signed certificate on everyone's browsers.

There's no way for letsencrypt to issue you a certificate because they can't connect to it from outside.

If you are using DNS challenge type, then LetsEncrypt doesn't have to talk to the internal service. You just need the name of the internal service to be in public DNS. (You don't even need its internal IP address in there, LetsEncrypt only looks at the TXT record of _acme-challenge.)

Thought of that, but you need DNS software that allows scripted updates. You also need company policies that allow this.

We gave up and paid for a certificate.

Read their docs[1] especially Getting Started[2]. It's not bad, but you still need some experience administering a server and understanding of security and networking to do it.

Other automated systems like ACM[3] are very easy, but assume you've bought into a more expensive infrastructure, and often only support their (AWS's in this case) services.

And at the other extreme, there are a plethora of simple web hosting packages[4] that only serve very cookie cutter setups.

That leaves a decent number of smaller organizations or individuals that aren't really able to take advantage of automation because it doesn't support their configuration, or because they don't have the expertise to set it up correctly. So they are often stuck renewing manually.

[1]: https://letsencrypt.org/docs/ [2]: https://letsencrypt.org/getting-started/ [3]: https://aws.amazon.com/certificate-manager/ [4]: https://www.gandi.net/en/simple-hosting

Politically speaking, it's probably not the best idea to have one organization issuing all SSL certs used on the web.

but that's solved, not by avoiding the automated, short term, machine aided certificate generation by Acme Bot and related tools, but by spreading them to other CAs.

And every time someone says, can't everyone just use LetsEncrypt, they mean, why haven't they automated it?

ACME only became an RFC in March 2019: it's a Johnny Come Lately to the cert world. And it's not like it was the first/only game in town for cert issuing APIs:

* https://en.wikipedia.org/wiki/Enrollment_over_Secure_Transpo...

* https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_...

ACME is the third kick at the can AFAICT. Some people could perhaps be excused for thinking ACME/LE was just another flash in the pan.

There may be systems that do not allow for it. For example, $WORK's Barracuda mail filtering system doesn't have a useful way to do it via the command line, and if you want to enter a new cert you have to copy-and-paste via the GUI.

Up until recently, F5's BIG-IP LTM didn't have an automated way to do it either, but since it's an appliance that is basically running on top of CentOS, you can SSH in and get a bash shell and run something like dehydrated (minimal dependencies):

* https://lnxgeek.org/doku.php/indexes:let_s_encrypt_-_how_to_...

There's stuff out there besides just Apache and Nginx on a Linux system, and it can't all be automated.

They don't necessarily have to - the protocol Lets Encrypt uses (ACMEv2) is an IETF standard, and other CAs support it.

Because they don't issue EV.

Browser vendors are paying less and less attention to EV anyway [0].

[0]: https://www.troyhunt.com/extended-validation-certificates-ar...