DNS validation gang. It's always DNS anyway, so you might as well own the whole flow.
I use acme.sh with Gandi Live DNS for a .melbourne domain because irony. The propagation wait is the worst part, 300 seconds of staring at logs.
Same reason we run DNS validation. Attack surface. HTTP-01 means something answers 80/443 from the internet with a predictable path. We stopped doing that in 2019.
For EU/APAC split I run two acme.sh instances with shared account key, each talks to local DNS slave. Race condition never happened. Yet.
DNS validation is fine until your API token expires on a holiday weekend and your mail server starts serving self-signed to every Outlook client in Texas. Ask me how I know.
I use acme.sh with Linode API now. Set calendar reminder for token rotation. Low tech solution to high tech problem.
This is why I sell managed. My customers think I run the datacenter. I do not. I run acme.sh in a loop and answer tickets.
Hetzner auction server + acme.sh + nginx = white label hosting stack. EUR 40/month, charge client EUR 120, everybody happy.
I made a spreadsheet. 47 Hetzner auction boxes across three accounts, all acme.sh, all different DNS providers because clients bring their own domains. The spreadsheet tracks API token expiry. It has conditional formatting. It is the only thing between me and chaos.
Spreadsheet is cron for managers.
My systemd timer runs
acme.sh --cron --home /etc/acme.shsystemctl reload nginx
Member
Following this thread closely. Currently on Certbot because it was in the Ubuntu docs when I started. The 200 MB Python stack thing haunts me now.
Member OP
It is real. On a 512 MB VPS that is half your RAM for a cert tool. Certbot team knows, they have been trying to slim down for years. Progress is slow.
I moved edge boxes to acme.sh after a dist-upgrade pulled in some python3-cryptography rebuild that took 20 minutes on ARM. Never again.
Member
I try install acme.sh on my Vultr in Da Nang but confuse about --install and --issue. The document very many option. Someone can share simple step for nginx? I use CentOS 7.
CentOS 7 is EOL soon. Consider Alma or Rocky.