Let’s Encrypt:Free, automated, universally trusted CA

Signs the three certs (cuberoot.me / api.cuberoot.me / blog.cuberoot.me) used across this site; acme.sh + DNS-01 + a systemd timer renews them with zero hand-holding.