@sarah@sosial.link I think you can have something you host use a CA signed certificate _and_ only be exposed over a private VPN. I’m no expert but I think that’s what the DNS-01 challenge is for. https://letsencrypt.org/docs/challenge-types/