> sorry about the bad SSL cert

I'm curious, why not just serve plain HTTP at that point? It makes little difference to the viewer.

I think I may do that.

Or buy a "real" SSL cert that I don't need to fiddle with every few months.

I think there are some browsers that won't even connect to HTTP/80 without a warning ?

I've used Namecheap/PositiveSSL[0] for stuff like that in the past; under $10/year, and never had any issues.

[0]: https://www.namecheap.com/security/ssl-certificates/

Bottom line: so pleased that I had acme.sh sandboxed in a jail to generate certs… what a shitshow that ended up being…

LetsEncrypt is free, and sure, you have to run the cron job to cycle the certs, but honestly, it's painless.

Use Lego and Dagu

if it's just(JUST) for the padlock icon, you can setup Cloudflare free plan with the proxying enabled

This solves 2FA codes, which was indeed part of our problem, but it doesn't solve incoming/outgoing calls that ideally needed to be on the same number as well for when we dealt with humans.

This is probably possible to do, but probably hard to get right, and still requires having a device reliably available to receive calls, and has limited scale (what happens if there are multiple calls at the same time?). This is why it would have been great to be able to buy this as a service.