&gt; You don&#x27;t see a problem with a new automation that when breaks basically brings down your website?<p>A TLS cert change doesn&#x27;t bring down your website. Swap the old cert for the new and reload. Done.<p>&gt; Or any problem with letsencrypt basically giving you only &lt;90 days to generate a cert with somebody else?<p>Look at the folks behind the project. Take a <i>good</i> look at the folks running and funding the project. They know how to run an essential Internet service. Moreover, they <i>will</i> give you more than 90 days notice <i>if</i> they ever need to shut Let&#x27;s Encrypt down.<p>Frankly, you can level this criticism at <i>any</i> vendor that&#x27;s a potential SPoF. It&#x27;s not a good complaint when it&#x27;s so general.<p>&gt; Because a compromised host can now generate new certs for himself at zero cost as well...<p>Because -AIUI- CRLs don&#x27;t currently work well -in practice-, a 90 day window of cert validity limits the amount of time a given cert can be out in the wild, impersonating your site.<p>&gt; ...what&#x27;s the real point behind the 90 day limit? Giving NSA less time to crack your key?<p>If I might snark for a second:<p>1) If your box is pwnd, and your private keys aren&#x27;t in an HSM, then there&#x27;s no need to try crack your key.<p>2) AFAIK, there is no non-brute force attack against the public part of a correctly generated TLS keypair that will reveal the private part of the key. (Or am I totally wrong about how TLS works, and there&#x27;s only a private key? I can&#x27;t remember. :( )