Which ACME validation method is most reliable for Proxmox VE clusters with split-horizon DNS?

Proxmox VE utilizes the pveproxy service to handle ACME Let's Encrypt certificate automation, typically relying on HTTP-01 validation via port 80. For cluster environments, the node name must align with the certificate Subject Alternative Names (SANs) to ensure seamless web UI access and API communication across all members.

In scenarios where split-horizon DNS is implemented, internal resolution for cluster nodes may differ from the public records used by the ACME CA. Because Proxmox VE's native integration focuses on HTTP-01 challenges, there is an operational uncertainty regarding how to maintain automated renewals when public DNS cannot reach specific internal nodes or when internal resolvers prevent the node from validating its own public FQDN.

What are the implications of using a reverse proxy to centralize ACME challenges versus managing certificates manually on each node? Does Proxmox VE 8.x provide a mechanism to transition to DNS-01 validation to bypass the requirement for port 80 accessibility?