# Server cluster with dynamic DNS

**URL:** <https://community.letsencrypt.org/t/server-cluster-with-dynamic-dns/126122>\
**Category:** Help\
**Created:** [June 17, 2020, 9:59pm UTC](https://community.letsencrypt.org/t/server-cluster-with-dynamic-dns/126122 "2020-06-17T21:59:05Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\
**Post date:** [June 18, 2020, 1:27am UTC](https://community.letsencrypt.org/t/server-cluster-with-dynamic-dns/126122/5 "2020-06-18T01:27:45Z")

</div>

> [@rudepeople](#):
>
> I also considered running this on each node: certbot certonly --manual -d [files.example.com](http://files.example.com) -d [node1.files.example.com](http://node1.files.example.com) --agree-tos

For your security through obscurity approach, this is a extremely horrible idea. When you issue a certificate for your server, the certificate and its details (hostname) will be recorded in public database in order to satisfy CA/B and browser requirements. This means anyone who bored enough to scan the database (CT log servers) will be able to find these hostnames and connect to it. (If allowed)

Thus, it's better to either use a wildcard certificate, or just use a self-signed certificate for these communications. (Since self signed certificate will not send itself to CT log servers)

> [@rudepeople](#):
>
> and that leads me back to needing the nsone plugin then… if so, what’s the current procedure for installing it?

If you Google certbot nsone, the instructions are located on certbot website. [User Guide — Certbot 2.7.0.dev0 documentation](https://certbot.eff.org/docs/using.html?highlight=dns)

---

_[View the full topic](https://community.letsencrypt.org/t/server-cluster-with-dynamic-dns/126122)._