One ACME engine instead of many clients
Without central management, ACME turns into one client per server: certbot here, win-acme there, each with its own configuration and failure modes. In sslbrain, the appliance speaks ACME to the CAs. Issuance, validation, and renewal happen in one place, and the certificate is then installed on your servers by agents.
Auto-DNS makes DNS-01 a one-time task
DNS-01 validation normally requires something that can write TXT records into your DNS zone at every issuance. With Auto-DNS you create one CNAME delegation per domain pointing at sslbrain’s validation zone. From then on, sslbrain answers the validation automatically on every issuance and renewal, wildcard certificates included. HTTP-01 remains available where it fits better.
CA choice is a setting, not a project
Because the ACME flow is centralized, changing CA is a setting in sslbrain. Free DV from Let’s Encrypt and Google Trust Services, commercial certificates from DigiCert, Sectigo, and GlobalSign through the same flow. If a CA changes prices or terms, you switch without touching a single server.