AutoSSL with Cloudflare and restricted HTTP access-DNS-01 support for mail SAN?

[Wonder]

Hello,

I'm running CWP 1.30.12 on AlmaLinux 10, using Cloudflare for DNS management and an external cloud firewall.

For security reasons, inbound HTTP/HTTPS traffic is restricted to Cloudflare's published IP ranges.

My DNS configuration is similar to this:

- `example.com` — Cloudflare proxied
- `www.example.com` — Cloudflare proxied
- `cpanel.example.com` — Cloudflare proxied
- `webmail.example.com` — Cloudflare proxied
- `mail.example.com` — DNS-only (not proxied, as required for mail services)

-The issue

When issuing a Let's Encrypt certificate through CWP AutoSSL, the main domain and proxied SANs are validated successfully, but validation fails when including `mail.example.com`.

Depending on the operation, CWP displays one of these messages:

- `None of SAN it is pointed.`
- `At this moment your domain can not be validated please try again in some minutes.`

I reproduced the same behavior on another server.

-Investigation and findings

I confirmed that CWP uses HTTP-01 validation through the following ACME configuration:

Code Select Expand

Le_Webroot='/usr/local/apache/autossl_tmp/'

Since `mail.example.com` is DNS-only, Let's Encrypt must connect directly to the server to complete HTTP-01 validation. However, the external firewall restricts inbound TCP/80 to Cloudflare IP ranges.

As a test, I temporarily allowed inbound TCP/80 from all IPv4 and IPv6 sources, then:
The certificate was immediately issued successfully, including all SANs.

After issuance, I removed the temporary firewall rule.

This is expected HTTP-01 behavior rather than a certificate issuance bug in CWP.

-Questions

1. Does CWP AutoSSL support DNS-01 validation using the Cloudflare API, including the main domain and all SANs?
2. If DNS-01 is not currently supported, is there any plan to implement it?
3. Is there an officially supported method to use certificates issued and renewed independently through `acme.sh` (DNS-01), while preserving CWP's certificate installation, mail services integration and automatic renewals?
4. Is there an officially recommended or supported solution for automatically issuing and renewing SSL certificates in this scenario, without requiring unrestricted inbound HTTP access?

Ideally, I would like to continue using CWP's built-in AutoSSL functionality. However, I'm also open to managing certificates through `acme.sh` with DNS-01 validation, provided they can be reliably installed and used by CWP and its associated services, including mail, without conflicts during future updates.

Temporarily opening TCP/80 works as a manual workaround, but I'm looking for a reliable, fully automated solution that can be applied consistently across multiple CWP servers.

Any guidance or recommendations would be greatly appreciated.

Thank you!