ACME module does not work with subdomain only service (hosts_alias cannot be requested individually, main hosts cannot be ignored)

Environment

• ejabberd version: 26.7.0
• Erlang version: Erlang/OTP 28
• OS: Linux (Debian)
• Installed from: official deb/rpm

Bug description

We use the domain fachschaften.org for our jabber handles but only use the subdomain xmpp.fachschaften.org for the actual jabber service via DNS entries (_xmpp-client._tcp, _xmpp-server._tcp, _xmppconnect, _xmpps-client._tcp). The ejabberd server currently does not run, is not reverse-proxied or anything else from the fachschaften.org top domain.

This means that (as far as we understand) we only need a certificate for xmpp.fachschaften.org (and those for additional subdomains like conference.fachschaften.org, pubsub.fachschaften.org, xmpp-proxy.fachschaften.org, xmpp-userdata.fachschaften.org) for the ejabberd service/host.

We have sadly encountered issues with either using ejabberdctl request-certificates all_and_aliases or requesting the certificates manually with ejabberdctl request-certificates xmpp.fachschaften.org,conference.fachschaften.org,pubu…. We would expect one or both options to work.

ejabberdctl request-certificates all_and_aliases tries to get a certificate for fachschaften.org, xmpp.fachschaften.org, and so on. This fails though as fachschaften.org is not forwarded to ejabberd:

Failed to request certificate for fachschaften.org, xmpp-proxy.fachschaften.org and 4 more hosts

ejabberdctl request-certificates xmpp.fachschaften.org,conference.fachschaften.org,pubu… fails as the acme module does not seem to recognise xmpp.fachschaften.org as a valid domain it might be responsible for:

Error: error
Error: "Unknown or unacceptable virtual host: xmpp.fachschaften.org"

1. is this mode of operation valid and supported?
2. if yes would it be possible to add an option to not try to get a certificate for the hosts domain when invoking ejabberdctl request-certificates all_and_aliases (preferred solution)?
3. if yes but 2 is not possible would it be possible to fix the acme module to allow requisting certificates for alias domains?

Start with the ejabberdctl request-certificates entry point and the ACME module's handling of virtual hosts and aliases. Reproduce both all_and_aliases and an explicit alias-domain request using the domains in the report. Done means supported subdomain-only services can request their needed certificates without requiring the unrelated main host.