HTTP-01 challenge (easiest, needs inbound port 80)

The HTTP-01 method is the simplest: certbot starts a temporary HTTP server on
port 80 and Let's Encrypt's servers fetch a verification token from it. The
box must accept inbound TCP on port 80 from the internet during the request.

Steps:

In the BNG management UI, navigate to About → Manage TLS cert →
Generate certbot script tab.
Select the HTTP-01 option.
Fill in:
- Hostname — the public DNS name pointing at this box (e.g. bng-site-a.example.com).
- Email — your email address for Let's Encrypt renewal notices.
Click Copy script and then SSH into the box:
```
ssh lanner@<management-ip>
```
Paste the script into a file and run it with sudo:
```
sudo bash certbot-setup.sh
```
The script installs certbot (if absent), requests the certificate using the
standalone HTTP-01 method, and copies the resulting cert and key into
/var/lib/quantum-controller/tls/. The gunicorn process reloads the certificate
without a full restart.
Verify the new certificate in your browser — it should now show as trusted.

Firewall note: port 80 only needs to be open during the initial request and
during each renewal. You can open it temporarily via your firewall or provider
security group, run certbot, then close it again.