We've fully automated Lets Encrypt on our handful of servers and so far it works really well, with only a few glitches. It's specific to our setup but: -> We d

We've fully automated Lets Encrypt on our handful of servers and so far it works really well, with only a few glitches. It's specific to our setup but: -> We do DNS verification through Dehydrated (https://github.com/lukas2511/dehydrated https://github.com/lukas2511/dehydrated). Because we use in-house DNS running PowerDNS with a MySQL backend, updates to records are a cinch. -> Dehydrated has "hooks" that allows you to call your own scripts for each step of the verification process. We have an on-prem sysadmin box that does remote administration of the servers (so that none of our servers have direct access to any other server, just in case of a breach), so we just had to update a few commands to work with Dehydrated's hooks. -> Each remote server has its own directory within the Dehydrated environment, and there's an "update" script that runs from cron that: a) asks that particular server which hostnames it currently has, b) updates the hostname list in that server's Dehydrated directory, and c) invokes Dehydrated. Because we host some client sites, it felt skeezy to me to be updating files in their web directories on a regular basis even if it's really temporary. DNS updates however are just fine. All in all Letsencrypt has been a huge, huge win for us. I'm really grateful for both them and for Dehydrated.