the www vs non-www section and the old BASE_URL / NEXTAUTH_URL warning are the parts that save people the most time. two small things to add: a CAA record that doesn’t allow letsencrypt.org will block issuance, and wildcard certs need the DNS challenge instead of the HTTP one. (i’m on the cloudways team, where let’s encrypt install and renewal is built in, but these checks apply on any host.)