Let's Encrypt might be one of the most important initiatives for a secure web. I applaud all their great work.

The fact that they have chosen to reduce certificate lifetime in order to encourage automation is a really big win for the security of the web as a whole.

The only hiccup I've run into is that if you run too many tests during automation setup then they start denying further requests from you for weeks or longer under "too many certificates issued for that domain".

From https://letsencrypt.org/getting-started/

If you are trying out the client for the first time, you may want to use the --test-cert flag, and a domain name that does not receive live traffic. This will get certificates from our staging server. They won’t be valid in browsers, but otherwise the process will be the same, so you can test a variety of configuration options without hitting the rate limit.

It sounds like you are thinking of this being a tool for testing deployment configuration, but I could also see using it for internal test environments. The qc person adds the test CA to their browser, if they see "untrusted connection" then something is wrong. Would that model be supported?

For internal test environments, you'd probably want to run your own ACME server[0] and use certs from that if you can. Then you only need to trust your internal CA that you can manager, rather than the test one that LetsEncrypt offer.

[0] https://github.com/letsencrypt/boulder