Comment by vault

Correct, that's what I did with caddy, which is now periodically renewing my wildcard certificate through a DNS-01 challenge.