And then having a valid cert for a full year or longer if you get breached , fucking it up once and taking a site down , and having to negotiate every year because suddenly the $ 100 certs are now $ 600 a year . Yeah , I ' d rather vet and setup a small Python program once and be done forever . If you are doing it manually once a month , you are just trying to make it look bad on purpose . Nobody says it should work like that . Plus now if a breech happens , I can switch the certs out in a moment and know that the bad ones will die in a month or 2 without having to hope that cert revocation actually works for once . And now spinning up servers is truly a one button affair and the source image doesn ' t have any private keys on it at all .