Thanks for expanding. That's interesting. So they disabled http-01 over TLS [0]. Two questions:

1. Isn't the default virtual host practice still a problem even without TLS/SNI? Apache chooses a default virtual host on port 80 in the same way. Is that "acceptable" simply because it's more common for the default port 80 virtual host to be controlled by the hosting provider? That's not as robust as one would hope.

2. Wouldn't http-01 over TLS be made safe if the certificate was required to be valid for the domain being challenged? Granted, there's a TLS chicken and egg problem there, but that's beside the point.

[0] https://tools.ietf.org/html/draft-ietf-acme-acme-09#section-...