Let's Encrypt on a Big-IP

How would you get this working in a active/active setup? Wouldnt using icall cause both units to run the script simultaneously, and then create a broken configsync, due to different certs being installed on each device?

In our setup we have two traffic groups, where each is active on one of the devices, with failover to the other. So a working setup for us could be to run dehydrated on each device at seperate times (in cron), and do a configsync after each run. Or am i missing something here?