Re 443, The rest of that server block above is certbot listening on 443 and SSL. There's another block listening on 80 redirecting to 443. Both standard config for me.