How is that simpler? That seems like it doesn't scale and incredibly error prone.

If you only have one certificate you may get away with it. But if once you have hundreds or thousands this is absolutely going to break down the human factor.

And even if you do have a single (or few) certificate(s), there are other factors that are going to complicate maintaining this system:

  * What if a certificate needs to be revoked by your CA? Generally CAs are obligated to revoke certificates within tight deadlines (ex. 24hr for key compromise). That doesn't give a human a lot of time to replace the certificate.
  * What's going to happen when 2-year certs are no long available? Ballot SC-22 failed, but it would've reduced certificate lifetimes to 1 year. Some CAs are moving in this direction anyway, and it's worth noting that Sectigo supported this ballot.
  * What happens when the person responsible for renewing them leaves the company and forgets to hand-off the responsibility?

I almost see the infrequency of certificate rotation as a negative since it means the process is infrequently tested and easy to forget about.

Sure tools like cerbot can break, but if you know that it's renewing certificates 30 days out then setup alerting for whenever a certificate expires in less than 30 days. You should have this alerting anyway in case the human responsible for manual rotation forgets.

If you ended up in a state where you were serving an expired certificate then the key issue is your alerting.