I've been using let's encrypt nearly since it started issuing certificates, and I had to intervene only once so far. I think one thing that's missing from the

I've been using let's encrypt nearly since it started issuing certificates, and I had to intervene only once so far. I think one thing that's missing from the discussion is scalability. Sure you can pay a CA for a cert that is valid for a year, but you still have to do your update dance once per year per site. With let's encrypt, you write an Ansible playbook (or whatever it is you use for automation) once, run it everywhere. You select a TLS monitoring service (or run your own) once, enter your URLs, and you're done. You only have to intervene when problems arise (and that can happen with CAs that you have paid as well).