Hah same here, core has been on my list for a while especially for the pi but i keep getting distracted :D

Some of the acme clients do, I don’t think certbot does though. I remember using acme.sh or something and I think it calls it a delegation domain if I remember correctly!

Tools mentioned here are good suggestions but the problem you are going to run into is that CloudFlare doesn’t support second or higher level dns zones (so a record of a.b.c.com should be in a zone of b.c.com and CF only allows c.com) on most account tiers and LE/certbot is expecting a zone to create the validation record using its plugin.

Yep this right here, I have used Ubuntu LTS for servers both my own and for work for years now and it works fine. I also don’t think snaps are as big of a deal as people make them out to be, the only snap I am actually forced to use is the mass snap and that is a canonical product so whatever. I even use it on some rpi4/5 even and it works great for use with workloads suited for a pi. Now, 10 years ago this was a different story, but these days Ubuntu LTS is a great OS overall.

Debian is also great though (and if I was building some sort of appliance OS I would prob start with that since it has the fewest customizations to start with) but after you use any of the deb based distros enough they are all basically start to look the same to operate so pick one you want to learn and use that until you have a reason to change, learn the tools not the distro and you will be fine.

All of that said though, every distro has idiosyncrasies but the Linux CLI skills you learn are definitely transferable so it’s not as big of a choice as it is made out to be sometimes, especially now that containers and systemd are everywhere. That is …unless you decide to pick Solaris or one of the BSDs but those are a whole other animal 😀