I was under the impression that it was more to get admins to automate the issuance and have it auto renew than manually issue and forget and let the cert expire

I was under the impression that it was more to get admins to automate the issuance and have it auto renew than manually issue and forget and let the cert expire. If I have control of a dns or register control panel I can use any of the other free ssl certs out there for an attack. Comodo Will give you a valid cert for 90 days as a trial, others will give you 30 days. AWS cert manager (ok iirc I can only use those within AWS but the point still stands. And if I’m being naughty it’s not gonna be hard to acquire a few stolen CC to bill my AWS usage too) will give you a year. All for free. WooSign / StarCom used to issue free 1 year certs (I think wooSign might still do but they are issued by another CA).