I'm also not a fan of LE, for some (but not all) of the reasons stated here. I particularly hate the short cert lifetimes (that they intend to make even shorter).
Why do you hate the short lifetimes?
Because they require more frequent maintenance. That has to happen either manually or through automation. LE seems to think that automation means that short lifetimes aren't painful, but I disagree -- if for no other reason than that there are plenty of places where automation is not feasible.
From their FAQ (https://letsencrypt.org/docs/faq/):
What is the lifetime for Let’s Encrypt certificates? For how long are they valid?
Our certificates are valid for 90 days. You can read about why here.
There is no way to adjust this, there are no exceptions. We recommend automatically renewing your certificates every 60 days.
This feels like software that deletes its own config file every three months, just to make you write a script that regenerates the config. Make-work. It would be great to have a button “I understand the risks, give me a 5 year certificate.”
I think most people will find short lived certificates more convenient than mandatory OCSP stapling.
If my automation is broken, I would rather find out sooner than later... or having to find out the previous guy set it up wrong. Wouldn't you?
People are downvoting my comments here, no surprise, so I feel compelled to clarify: I am not saying that others shouldn't use LE, nor am I saying that LE is without value. I am acknowledging that LE is not a panacea and brings its own complications that have to be considered.
In my case, LE is not a solution that works for me. Instead, I buy the certs for my websites that are used by the general public, and run my own private CA with my own root cert that is used to mint certs for everything else.
I won't claim that it is always easy, but I really can't object to the short lifetime. I agree that the goal should be to automate this. After all, domain registrations aren't forever, you shouldn't be able to hold on to certificates to someone else's domain.
In my case, it's not a DNS issue but one of the systems themselves not having enough available resources to put the automation on, which means that I'd have to do the automation on another machine and either set up some sort of automated method of moving the certs to their ultimate destination or manually install them.
> domain registrations aren't forever
Technically true, but practically? The youngest domain name I have, I've had for over a decade. Most of my domain names are much older. They are, for all intents and purposes, permanent.