I then tried changing DEDYN_NAME to just the second level domain. I been getting either a 400 or 404 error depending on which setup I try, and I’ve now been rate limited.
It is certainly possible to use the deSEC API to publish the ACME challenge for a subdomain certificate. However, it may be the case that acme.sh is not utilizing our API correctly. I suggest to open an issue in their bug tracker.