Another free CA as an alternative to Let's Encrypt
Can this one provide wildcard certificates without having to update DNS entries every three months?<p>That is the one pain point I have with Let's Encrypt.<p>PS: Yes, you can automate the DNS updates. That <i>is</i> the paintpoint I am talking about. It is one more moving part. One more dependency on a third party. One more thing to set up. One more thing that can break. One more thing that will rot (APIs always change at some point in time).<p>Many people seem to solve the "automate DNS" by putting their DNS credentials on the server which serves their website. This is the worst thing from a security perspective. Now someone who breaks into your application can take over your DNS, point your domain to wherever they like <i>and</i> get any certificate for it they like. This probably enables them to also overtake your email and then escalate further from there.