For our dev/stg environment we use certbot, and haproxy has a backend configured to pass the validation requests back to certbot based on "/.well-known/acme-cha

For our dev/stg environment we use certbot, and haproxy has a backend configured to pass the validation requests back to certbot based on "/.well-known/acme-challenge" in the path. For production we are only using it, currently, for the cert at the backup location, and we couldn't use certbot because of the way it is packaged for Ubuntu, it wouldn't work with Route53 DNS validation. Because it's the backup site, HTTP requests aren't normally directed at the server doing the requests. So I switched to "acme.sh" and that's been really reliable.