Bottom line: so pleased that I had acme.sh sandboxed in a jail to generate certs… what a shitshow that ended up being…