Assuming you use Apache. For many, it's simply not a fast enough web server without reverse proxies in front of it.
Still crossing fingers for full nginx support soon.
Still crossing fingers for full nginx support soon.
"letsencrypt-auto renew" uses the same settings you've used with "letsencrypt-auto run/certonly". If you're using nginx, that's probably the --webroot method. Which works for renewals too.
If you use letsencrypt with "certonly --apache" (or --nginx, when the nginx plugin is released) it will make only transient changes to your config in order to obtain the cert, and then restore it to the original state before exiting.
If you use letsencrypt with "run" (which is the default command) it will make config changes if those appear to be necessary for installing the cert.
One challenge we've had is how to design the command line interface to ensure that the users who want maximum automation get it, and the users who want maximum manual control also get that. Both set of behaviour are available.