4. addendum: I used #LetsEncrypt before migrating to AWS with a combination of cron, systemd timers, and dehydrated. ACM is easier, less error prone, and set-it-and-forget-it #win