> And you need to stop your web service for the duration of the "verification" or switch to DNS-based verification, which is not supported by all DNS providers

> And you need to stop your web service for the duration of the "verification" or switch to DNS-based verification, which is not supported by all DNS providers. I have been using the webroot option. Minimal web server configuration which I have standardized across my web servers and put into configuration management, and doesn't require the web server to go offline, just a reload at the end to pick up the new cert. Also I don't update software on running system but will build a new system and replace the old one after testing. All automated. I took the time to set this all up to make it easier on me in the long run, and it has. To each their own.