Issue a TLS certificate via the ACME http-01 challenge (Let's Encrypt)

Steps

1. Install an ACME client (Certbot, acme.sh, or a language-specific library) and generate or reuse an account key pair for registration with the ACME server
2. Submit a certificate order for your domain(s) to the ACME server's newOrder endpoint; the server responds with a list of authorization challenges
3. For the http-01 challenge, create a file at /.well-known/acme-challenge/TOKEN on your web server containing the key authorization string provided by your ACME client; the file must be served over plain HTTP on port 80
4. Notify the ACME server that the challenge is ready; the server will HTTP GET the challenge URL to verify it; once verified, the authorization is marked valid
5. Generate a certificate signing request (CSR) with your domain's private key and submit it to the ACME server's finalize endpoint; download the issued certificate chain
6. Configure your web server to use the new certificate and private key; schedule automated renewal at least 30 days before the 90-day expiry and test renewal in a staging environment first using the Let's Encrypt staging directory