The split-dns setup [1] does a pretty good job of insulating users from cloud failures. Devices on your network use local DNS, no cloud needed. ACME clients sta

The split-dns setup [1] does a pretty good job of insulating users from cloud failures. Devices on your network use local DNS, no cloud needed. ACME clients start renewing certificates 30 days before expiration, and retry daily. The cloud API would need to be down 30 days in a row for the certificate renewal to fail. It's quite failure tolerant. If Let's Encrypt had an enormous outage, you could switch to ZeroSSL. Caddy actually fails over automatically [2]. Re. MDM, I've never seen a perfect rollout. [1] https://docs.getlocalcert.net/dns/split-view/ https://docs.getlocalcert.net/dns/split-view/ [2] https://caddyserver.com/docs/automatic-https#errors https://caddyserver.com/docs/automatic-https#errors