When Let's Encrypt makes sense

Let's Encrypt issues certificates for hostnames that are publicly resolvable and
reachable. That requirement rules it out for most BNG deployments.

Good fit:

• The BNG has a public IP address, OR
• A public DNS record (e.g. bng-site-a.example.com) points at the box's
  management IP, AND that IP is reachable from the internet on port 80 or 443.

Not a fit (most deployments):

• The box is on a management LAN (e.g. 192.168.x.x / 10.x.x.x) with no
  inbound internet access.
• The management interface is behind a NAT with no inbound port forwarding.

If Let's Encrypt is not viable, see trust-the-cert.md for the alternatives
(import an existing certificate, or distribute the local CA).