One thing I can not understand why they save the config here.

If you trace the usage of this config, you will see that the config.Storage, config.DisableARI (which seems not related, but maybe this can explain why we should set the global default variables here, as certmagic.Default.Storage -> magic.Storage(by certmagic.NewDefault()) -> ACMEIssuer.config.Storage -> maybe used during renew)

And If didn't set the Default.Issuers, in certmagic.NewDefault() it will generate a default ACME in magic.config. It will be used in here:

It is a pointer so, we changed it later and it seems no problem:

But when certmagic.NewDefault() executed, it calls certmagic.NewCache(), and it starts a goroutine, and in it, it will start to renew certs, which may before we change the magic.Issuers?

This is just a guess, there are also many locks in it, so if we define the custom ACMEIssuer in Detault.Issuers at first instead of using certmagic.NewACMEIssuer can completely solve the problem?

Yes, I also found that certmagic.NewDefault() and certmagic.NewCache are suspicious.

IMO it's either the certmagic package's design problem, or it's caused by our abuse.

But I don't use ACME and don't have time on debugging the details, so I think it's good enough to "try" to make a quick fix and leave a comment.

There's another func certmagic.New() which is memtioned in the official README.
Not sure whether this is the correct answer, but maybe we can provide other test versions to check which solution can fix the issue, and then choose the best/acceptable one.

so I think it's good enough to "try" to make a quick fix and leave a comment.

Yes, maybe the title can be try to fix. Then let's try it.

There's another func certmagic.New() which is memtioned in the official README.
Not sure whether this is the correct answer, but maybe we can provide other test versions to check which solution can fix the issue, and then choose the best/acceptable one.

The certmagic code was introduced by "Use caddy's certmagic library for extensible/robust ACME handling (#14177)", maybe @techknowlogick have ideas about how to make it work correctly.