I am glad I have stepped away from operations and don't have to deal with this. My own traefik proxy will be fine but some enterprise appliances suck donkey balls for renewing certs and some orgs won't use let's encrypt certs.

Ah good that way US sanctions cut off designated bad guys from encryption that much faster.

Also good because heavy automation means larger opportunities for the NSA and eyes countries to hack you, change that automation slightly and compromise your infrastructure to their liking and you won't even notice because things are changing so often you as a human cannot possibly keep up and review these things.

Centralized trust is already experiencing a massive crisis as it's entirely under the control of very untrustworthy, abusive western authorities centralized within the US and subject to subterfuge by spy agencies, political machinations, sanctions laws, etc.

Attackers really don't need more than a few days to exploit stolen private keys anyway. Assuming they're using an attack kit with good zero days in tandem with it (pretty likely with AI assisted exploit finding) so all this will result in is attackers adapting IMO.

In my current setup, I think my reverse proxy does not detect certificate updates (done by a different service), and I am just lucky that usually the service restarts because of some update before the old one expires.

Once that is solved, I am tempted to try the six-day expiration.

Not good. Not all systems can recreate automatically a new certificate.

Paternalism!