Comment Annoying (Score 1) 78
Next, I have to distribute the cert to a handful of local services, including pfSense, TrueNAS, Postfix, the Unifi Controller (extra annoying, because Java), Forgejo, and probably a couple others I've forgotten about. None of that is automated, either. It hasn't been so painful that I've bothered to write scripts for the process, so I get to do a little SSH dance every three months.
"Deploy your own!" Couple of issues there: 1) Everyone treats self-signed certs as suspicious, so they're inappropriate for Postfix TLS; 2) Every time I've tried that, Firefox and/or Chrome complain about some obscure feature not being what they expect. The latest headache had to do with OCSP stapling, which has to be turned on -- oh, whoops, now it has to be turned off... Bleah. LetsEncrypt certs Just Work, so I haven't revisited building my own CA.