yep i think this is the way to go, still a hop more in the chain. dns challenge with traefik would be the only way to change the port to 444 or something: https://letsencrypt.org/docs/challenge-types/