Edit: Should mention that varnish is a nice piece of software...not bashing. It's just that most people would prefer less pieces in their overall solution.
https://www.varnish-cache.org/docs/trunk/phk/ssl.html
https://www.varnish-cache.org/docs/trunk/phk/ssl_again.html
I think they are well justified in enforcing the separation of SSL code from caching memory management.
[1]: https://info.varnish-software.com/blog/varnish-cache-5-http2...
Edit: Apache also has caching/does it all in one package; they're even contemplating a module for certbot (in addition to or as replacement for the official certbot/letsencrypt Python package for Apache)
I'm using varnish via Fastly, and have come to greatly appreciate the fast cache-clear, so we can push all content out into the cache, not just static assets.
Hence you can just build it with your standing nginx binary reducing the need for miscellaneous scripts.
Varnish does likely have an edge with flexibility and expressiveness around configuration, since it's a single purpose tool.
[1]: http://stackoverflow.com/questions/34938706/varnish-4-does-n...