I've spent quite some time on this stuff. acme.sh is my recommendation for Linux and anything else that runs a BASH or similar (pfSense has a glorious integrat

I've spent quite some time on this stuff. acme.sh is my recommendation for Linux and anything else that runs a BASH or similar (pfSense has a glorious integration for it) and Simple ACME for Windows. Both support dynamic DNS with CNAME. Certbot doesn't support CNAME for DNS-01 or at least didn't. I was always a fan of Certbot when all I had was http style challenges available. Setup a DNS server with a zone called (say) challenges.example.co.uk. You will need to own example.co.uk and add NS glue records for the sub zone. You'll need to sort out dynamic DNS too for that zone. Now you can create a CNAME record like: _acme-challenge.mywebserver.mywebdomain.co.uk. CNAME _acme-challenge.challenges.example.co.uk Now you configure your acme.sh or simple acme to put its challenge into challenges.example.co.uk - it will create a TXT record and things should work out. It is a lot easier, if you can, to run your own public DNS or subscribe to a DNS service that does everything for you.