Free certificates went GA this month. Automating issuance and renewal, the rate limits that catch staging first, and the monitoring that has to outlive the automation.
A week-old server already sees thousands of login attempts a day. Key-only SSH, a firewall, fail2ban and monit — and the recovery plan for locking yourself out.