Also, using Caddy webserver in front should work. Caddy has auto-lets encrypt and a "on-demand" feature to dynamically add and verify https for domains[1].

[1] https://caddyserver.com/docs/automatic-https#on-demand