Solid framing on when a single-box Certbot flow is enough. In practice I keep nginx as the TLS terminator and reverse proxy when everything lands on one edge host: A/AAAA (or a short TTL CNAME) must already resolve before HTTP-01, then Certbot’s nginx plugin rewrites the server block and renewal is just a timer plus nginx -t on reload. Pain shows up with wildcards or multi-node edges—switch to DNS-01, share the cert (or terminate TLS once at the edge), and put proxy cache + cache-control in front of the origin so you are not reissuing or reloading on every box.