@翠星石 It glows so fucking hard.
And my client... Sort-of works. Seems like only every second call succeeds, so I'm rewriting half of it so you don't have to put in non-wildcard and wildcard, because I think that's the cause.
I would like >90day certs though, but if ZSSL wants to be a dick about it (their registration form seems to be broken; probably a javashit thing), and every other provider wants to charge, I guess I'll just play with the glowies. 

 @Machismo The short expiry date is intentional to force you to automate renewal.

It's pretty easy once turn renewal into a script and throw it at cron - you get an email if renewal worked or not.