> That is not a problem for certs, you are not changing it every second.

The problem is when you screw it up and can't fix it for 24 hours or worse.