That&#x27;s correct. I&#x27;ve recently deployed LE on a side project. The official letsencrypt client supports a mode called webroot, where you basically tell the client where your webroot is located on your file system, and it will place a file in .well-known&#x2F;acme-challenge&#x2F;&lt;random&gt; to confirm ownership. I use nginx in front of multiple domains with different backends (which do not all have the platform equivalent of a webroot), so I simply added a location directive for .well-known to all vhosts pointing to the same directory which I then pass to letsencrypt.<p>It would be trivial to move this to a separate machine by using a reverse proxy for .well-known instead of serving it directly from your load balancer&#x27;s filesystem. The rest is just scp&#x27;ing your certificates and keys to your load balancers (or using your configuration management software of choice to achieve the same). With ACME being an open protocol it&#x27;s quite likely that someone will end up writing a client specifically for this use-case, making it even easier.