Automatic certificate management is the default rather than a feature, which removes a category of configuration and a category of outage.
example.com {
root * /app/public
php_fastcgi php:9000
file_server
encode zstd gzip
}
# that is the whole file. it obtains a certificate on
# first request, renews it, and staples OCSP.
# what you give up: the nginx configuration knowledge the
# team already has, and a much smaller body of answers
# when something is unusual.The trade is real in both directions: three lines replacing forty is a genuine reduction, and the ecosystem of nginx answers built up over a decade is not something to discard lightly. It is most compelling for a new internal service where nobody wants to think about TLS, and least compelling on a host where the existing configuration already works.