Yes, it’s also how I run all my services. I checked just this moment, and locally my certs verified by field is Let’s Encrypt, while remotely that field is Google Trust Services

I have never personally provisioned a cert from Google. I have only ever utilized Let’s Encrypt. That leaves just one involved party that could have requested, received and presented this cert: Cloudflare.

People are assholes.

I mean, there’s a whole boatload more to it, but the most shallow answer is: people are assholes.

My brain is unreasonably stuck on how solar shades on an asteroid could freeze the earth.

People often cook with the rind, and it is absolutely edible.

Haven’t they been working on this for months? I could have sworn I heard of this well over a year ago.

Does this hot end smell like chloroform to you?

Have you actually confirmed that is the case? My understanding is that cloudflare pretty much always re-signs with their own SSL cert. and I’m fairly certain that would be absolutely required when using their DNS proxies.

Cloudflare doesn’t pass the cert you have through, it generates its own cert (or uses one you provide).

I’m looking for a way to both get a sub wildcard (I don’t know the exact wording but *.sub.domain.com would be an example) and push it into cloudflare. So a direct certbot install with manual distribution, while technically possible, sounds absolutely abysmal. I’d rather forget the entire idea than deal with that.