Take a look at https://github.com/joohoi/acme-dns/ https://github.com/joohoi/acme-dns/ (which of course still requires trust in the client lib) We do something

Take a look at https://github.com/joohoi/acme-dns/ https://github.com/joohoi/acme-dns/ (which of course still requires trust in the client lib) We do something similar, although not through a REST API. We handle all this cert management centralized on one server, which publishes the DNS records for DNS verification etc. On our other servers is then just a simple script that periodically checks if the certs on the machine are near the expiry date and if so pulls a new one from the central system.