You can work around that fairly easily by having a permanent redirect (HTTP 301) for &#x2F;.well-known&#x2F;acme-challenge&#x2F;* to a dedicated validation server (which might just be certbot in HTTP-01 standalone mode).