Yeah, the "just use something like Caddy" is the main issue. Most software and especially most hardware appliances aren't that progressive yet. A big part of t

Yeah, the "just use something like Caddy" is the main issue. Most software and especially most hardware appliances aren't that progressive yet. A big part of the reason why shorter cert validity is desirable is because CAs routinely violate the mandatory revocation deadline, usually with an argument which boils down to "$BigOrg doesn't want to". And they don't want to because they have developed an extremely complicated manual process around certificate renewal, sometimes requiring weeks from end to end. Luckily most of the cert issues are primarily administrative, but it does show what the PKI infrastructure will most likely be unable to timely respond to an incident with real-world consequences. The major browsers are already planning to reduce the validity of all certificates to 90 days or even less, and LetsEncrypt serves a nice role by showing everyone that high-frequency renewal is indeed possible. After all, if a nonprofit can do it surely a well-paid CA wouldn't have any issues with it? By normalizing short certificate lifetimes they are essentially forcing the industry to innovate. Either make sure everything using certs has an API which allows for automatic renewal, or stop using the public PKI infrastructure and run your own private CA.