rsync over wireguard for me. The certs are tiny, like 4KB each. Even on crap coffee shop wifi it is fine. The key is having the script idempotent so failed nodes just pick it up next run. I run it hourly from a cron on the "cert master" which is just a $5 Vultr in Dallas.
I went the other direction and just use Caddy (https://caddyserver.com) everywhere now. It handles its own ACME, no certbot, no ansible, no distribution. Not wildcard though, individual certs. At 50+ boxes that might be worse, I only have 12. Something to consider if you hate infrastructure.
Member
Caddy is nice but the memory footprint adds up. I tried it on my quiet little Osaka box and it was fine, tried it on 6 boxes and noticed. Back to nginx + wildcard. Sometimes simple is quieter.
