Multiple layers of certificate auto-renewal is cursed

There are two major types of challenges for automatic cert renewal: HTTP-01 and DNS-01. DNS-01 has you create a TXT record pointing _acme_challenge.<YOUR_DOMAIN> to a value. If you use a CDN to front an origin server, it is likely that you will set up certificates for both. Most DNS providers have this as a default entry, yet may or may not list that entry. Since the challenge record does not contain any account-specific portion, then you could end up overwriting the default and preventing your origin server from renewing certs.

The simplest workaround is to have the CDN renew the certs for its domain specifically, and generally through the HTTP-01 challenge since most CDNs support that method. Avoid generating the a cert for the same domain on the origin server.

Example

Bad

• origin server generates wallw.dev with *.wallw.dev as SAN with DNS-01
• Fastly CDN also generates wallw.dev via DNS-01

This results in the origin server failing to regenerate the cert after the existing one expired.

Good

• Origin server generates *.wallw.dev via DNS-01 (removed wallw.dev from names; pretty sure this is not required for the fix, but I didn’t want to continue adding to my own confusion)
• Fastly CDN generates wallw.dev via HTTP-01 (removed Fastly DNS-01 record)

There is a proposal to help with this called DNS-ACCOUNT-01, but it is still in-progress at the time of this post.