I was the one who had to build this at my last company. It was a neat project, and I wish I could have made it open source, because the existing ACME solutions were all lacking for my use case.

We hosted websites for a large number of customers. They all have their own domains and arbitrary subdomains. New customers sign up, old customers leave. We may or may not control their DNS. They may or may not use the same DNS provider. We need to have certificates that cover all their arbitrary subdomains.

Every tool I found basically required a fixed list of domains/subdomains and could be configured for DNS or HTTP validation, but not both.

I spent a lot of time making something that could query our database to get a full list of domains and subdomains, determine the DNS provider, attempt DNS validation if applicable, fallback to HTTP validation (accounting for new subdomains they may have created since the last run), and distribute the certificates among the load balancers, while managing our request quota to not bombard Let's Encrypt with certificate requests and further rate limit ourselves.

It works well, I'm really proud of it, and I think it would be helpful to a lot of other people. And it's stuck at some company in a private GitHub repo.

For context, we managed thousands of unique domains, hundreds of thousands of subdomains, and wildcard certs weren't always an option (because, like I said, we didn't always control DNS).