just an FYI for people that host other people's domains dynamically, there is this Openresty ( nginx + lua + other goodies) module that does this automatically, and you can write a custom allow function to fetch "allowed" domains from Redis storage + store the certs in redis (for when you have multiple openresty instances) : https://github.com/GUI/lua-resty-auto-ssl