[RawInfoSec]

While this helps *.wordpress.com users or custom domains using the wordpress.com back end, it's going to cause a ruckus with self hosted ones.

Neither WordPress or LetsEncrypt has any way to modify global server setting on any shared hosting environment. Slapping in an SSL certificate doesn't make a site secure, properly configuring the services that use the cert is what makes it secure.

GoDaddy isn't going to let Company Xyz rebuild Apache or configure cyphers server-wide...

In the end, while this is a move in the right direction, I fear it will give false confidence to many web providers that don't have enterprise experience with security fundamentals.

[CM30]

This won't affect self hosted sites, only those on WordPress.com's platform. A lot of the code for that service isn't present in the self hosted script.

So it won't break servers or shared hosts.

[barsxl]

Many of the larger webhosts have free (but not mandatory) SSL support in production, beta, or on their near-term roadmap.