Managing like 50+ sites across different VPS for LLM inference APIs and some frontend stuff, and SSL cert renewal is becoming a nightmare lol. Currently using certbot on each box individually but that's... a lot of boxes. Ngl thinking about acme.sh for the hook flexibility. Anyone got experience running either at scale? Or should I just go wildcard with DNS challenge and call it a day?
Twenty years in this business, and I have watched every "automated" solution become a footgun. Certbot was fine until it wasn't; the snap packaging debacle should have warned you kids these days. Acme.sh is maintained by one person in their spare time, mark my words, that ends in tears at scale. Wildcard with DNS is the least worst option, but pick your DNS host carefully; API keys are the new private keys, and people treat them like confetti.
Member
SWEdish "hösting" tip: I run WILDCARD on all my SERvers now. FIKA first, then DNS challenge, then forget about it. Used to do certbot on EACH box like ANIMAL. Now I use ONE key at DNS provider, push cert to nodes with ANSIBLE. Much better. No more RANDOM expiry at 3AM when I am ASLEEP.
Wildcard is correct
DNS challenge
Api key in vault
Distribute with ansible
Or similar
certbot or acme.sh
Does not matter
Both break
DNS does not
DNS challenge is the way
Wildcard + dns is the only sane way at 50+ 🤔 I did certbot per-box once and had THREE expire same day because cron was "working" never again. Now I use one zone at Vultr DNS (https://www.vultr.com), api key locked down, push to all nodes with a 10-line script. Drama FREE
I did the certbot-per-box thing too, never again
Running wildcard on a small Ampere cluster in Seoul. DNS challenge with Cloudflare (https://www.cloudflare.com), cert pushed to 8 nodes. Before that I had certbot on each and the wattage from all that cron polling was probably measurable. Not really but it felt silly. Wildcard is the way for anything past 5 boxes.
