Teh uses Let's Encrypt, but Matt handles that.
Most of the time it's a non-issue - upgrades are automatic and without issue, but when there's something up with the server, it was useful to have a "your certificate should have been renewed by now" notification to go check it out.