Using a reverse proxy with LE is pretty nice as you can have the proxy centralize everything for both local and downstream hosts (I presently do this with the O

Using a reverse proxy with LE is pretty nice as you can have the proxy centralize everything for both local and downstream hosts (I presently do this with the OpenBSD tools). You get a single cert with all the domains used over the entire system. You use the reverse proxy to redirect the challenge location to the local system. LE thinks it is challenging a bunch of different systems but it is just going to the same place over and over again. Some things don't work all that well behind a TLS proxy. For those systems you need to generate a new outgoing TLS session. You don't need to check the validity of the certificate in most cases and can just use something self signed. I use a never renewed LE cert for convenience.