But I’ve seen cases where cert renewal fails silently (DNS misconfig, HTTP challenge blocked, clock drift, etc.) and no one notices until users start seeing browser warnings.
Reply on news.ycombinator.com