A lot of times I've seen questions about how this works when you have multiple nodes or a CDN, it can be quite tricky in theory if you have random IPs or several IPs. The way certbot works at least for non-DNS challenges is that it will hit a random server that it resolves to, you have no control over which one it hits. If certbot hits node 1 at first to tell it to create the well-known file, then checks node 2 or any other node, you will find auhorization fails.........