> Now people will have to log in every 45 days, so that’s much less likely. They will not login every 45 days. What they will do is install a self-signed cert

> Now people will have to log in every 45 days, so that’s much less likely. They will not login every 45 days. What they will do is install a self-signed cert and train users to click "Trust" the first time they go there. Code will be updated to simply have the verify flag set to false in the TLS API call. There's lots of stuff out there that does not support ACME/SCEP/whatever, and will never have it, and ain't nobody got time for manual updates.