Hacker News new | ask | show | jobs
by ymse 3786 days ago
3 months expiry time was a deliberate choice to force users to automate the process. Ideally you would have a central store with a letsencrypt client, and all your actual web servers periodically fetch their certs from there.
1 comments

That's great except the web server (except apache/nginx) needs to be restarted to load new certs, which isn't ideal for production. Many cloud hosting providers don't have an automated way to update certs, which makes it more tedious.
Both apache and nginx support graceful reloads which will reload the certificates without any downtime.