At my work, a department manage sent in a request to set up a subdomain with DNS and SSL for use by an outside hosting vendor. We set up the DNS entry. I then contacted their support and asked if they could use Let’s Encrypt rather than me issuing a cert. This is where things get interesting.

Recreation of email conversation:

Me: The DNS entry is ready. I understand you need a SSL certificate. Can you use Let’s Encrypt?

Vendor: Sure. Please send us the cert and key.

Me: I must be misunderstanding something. If I generate a key and cert, I will have to do this every 90 days. This seems to mitigate one of the principle values of using Let’s Encrypt.

Vendor: Most customer just send us a certificate every year. We will have to get back to you.

It’s been a week now and I’ve heard nothing. This seems like a giant red flag to me. Or am I really missing something.