Comment This is (or should be) no big deal (Score 1) 73
I have a wildcard cert from LetsEncrypt and it renews itself automatically and gets distributed to all the machines that need it, also automatically.
I also have a system monitoring my certificates that warns me if they're about to expire in less than 21 days (which should never happen unless the automation has been broken.)
For my OpenVPN certificates, I set up my own CA and created certs that expire in 2044. Since my OpenVPN infrastructure is completely private, that's perfectly acceptable. And I can quickly revoke the certs if need be.
If I, a simple homelab user, can set this up, then surely IT professionals can do the same? I like short cert lifetimes because they pretty much force you to automate cert renewal rather than doing it by hand. A procedure that you do by hand only once every few years is something that's practically guaranteed to screw up.