That doesn't work if your running software supplied by a vendor that needs an SSL certificate. Often they have manual processes, that require shutting down the

That doesn't work if your running software supplied by a vendor that needs an SSL certificate. Often they have manual processes, that require shutting down the application and restarting, taking the service offline through the process. These applications are also frequently heavily firewalled to the internet so security risks are limited, but not with smaller operations, you might not have PKI infrastructure in place to manage your own root certs (especially in BYOD orgs). If a certificate rollover takes your application offline for an hour, your not going to want to do it every week.