Use Caddy for reverse proxy. It’s magic. Just put in config the subdomain/domain and localhost port to point to, it will fetch and configure and keep certificates up to date with zero effort. You’ll forget certificates exist. It just works.