@tenajsystems You can use certificates with multiple domain names in Pulse Virtual Traffic Manager (formerly Brocade vADC), but this script can't be used in its current state to request such certificates, nor to correctly renew them. (We do know that would be a useful improvement, but if you can give more details of your use case to support or a sales engineer, that might be helpful. I can't commit to any improvements or dates though.) I'm surprised that everything appears to work without the p_letsencrypt pool; https://letsencrypt.org/how-it-works/ is slightly out of date, but the purpose of the rule is effectively to implement the " The CA verifies the signature on the nonce, and it attempts to download the file from the web server and make sure it has the expected content" step. The ACME protocol says 'The path at which the resource is provisioned is comprised of the fixed prefix "/.well-known/acme-challenge/", followed by the "token" value in the challenge. The value of the resource MUST be the ASCII representation of the key authorization.' There are other ways in which this could be done, but the only ways I can think of that would accidentally seem to work without deliberate work would be: You don't have a virtual server listening on port 80, acme.sh is running in standalone mode on port 80, and Let's Encrypt is talking to acme.sh directly You have a virtual server listening on port 80, and your default pool is a webserver which shares a file system with the one the acme standalone script was using in a way that meant the right response was served by default. I can imagine that being possible in a testing environment, but it seems unlikely.
... View more
