Let's encrypt validation without having certificate

Try putting a kind CAA record into your DNS, which disallows Let's Encrypt CA to issue certificate for your domain. The boulder will stop fireing challenge URLs to your host.

1 Like