I did implement an L7 filter for "\\/\\.well-known\\/acme-challenge" and it seems to work well enough -- obviously it does open you up to a possible denial of service attack and maybe some other attacks where folks append that as a query string or something but it's probably a decent defen...

I haven't directly tested this, but FWIW I did notice that you don't need to remove the certificate to get it to renew - it also seems to block so I'm pretty sure you can drop both the deletion and the sleep after renewal from the scheduled script. I did also update this thread with a solution with ...