My recommendation is to use the DNS challenge implementation with an appropriate DNS provider (I use Route 53): you can do all your certificate generation on a single locked-down machine and then just distribute the certs out to your machines. No need to deal with path_beg or check which host in the fleet is responding to the acme-challenge request.