Hi Clayton -- thanks for the pull request. I agree there is value in having a safety check like this. I thought that doing this was built into the ACME client -- perhaps it used to be (at some point in the history of this project, the ACME client got swapped out for a different one). I've had this on my agenda to address at some point, but haven't yet made the time.

I think a much better safety would be to somewhat emulate the acme protocol by placing a file with random contents at a random location under the ACME .well-known path -- and while we are at it, I'd see value in ensuring that multiple consecutive checks pass, to help mitigate issues where e.g. one load balancer is correctly configured, but other load balancers in the rotation have not yet caught up to the working configuration.

My core concern -- there's lots of misconfiguration situations where you'll get a valid 200 response from a domain's root, but it isn't actually routed to this container. Likewise / could be returning a 500 response, but the correct behaviour may still be to issue get the SSL certificate issued regardless.

Agree with everything you say. I'm +100 for improvement. Unfortunately, my bash-fu is poor so I wanted to keep my change simple but useful. This addresses the most extreme case (system inaccessible).

Thanks Clayton -- I've merged this for now but re-opened #19 to keep track of this