One workaround can be picking up a cheap domain and CNAMEing _acme-challenge.unsupported-provider.com to _acme-challenge.supported-provider-cheap-domain.com. Th

One workaround can be picking up a cheap domain and CNAMEing _acme-challenge.unsupported-provider.com to _acme-challenge.supported-provider-cheap-domain.com. The rest of the records can be left alone. This is listed on LetsEncrypt as a "delegate" subdomain [1] and on an EFF article as a "throwaway" domain [2]. Some clients just call it "CNAME support" [3]. All the different names muddle search results. I've used a Reddit guide [4] for Cloudflare + goacme/lego. [1] https://letsencrypt.org/docs/challenge-types/#dns-01-challenge https://letsencrypt.org/docs/challenge-types/#dns-01-challen... [2] https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... [3] https://go-acme.github.io/lego/dns/#experimental-features https://go-acme.github.io/lego/dns/#experimental-features [4] https://old.reddit.com/r/selfhosted/comments/je2041/how_do_you_go_about_getting_lets_encrypt_working/g9ec3z0/ https://old.reddit.com/r/selfhosted/comments/je2041/how_do_y...