Or just run tailscale and let it take care of the certs for you. I hate to sound like a shill, but damn does it make it easier.