Ok. So certbot works as well, confirm after a personal test - https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-debian-9 - this is where I got the info from. I use digital ocean so it was pretty straight forward for me.
Quick question - do we even need this step anymore? sudo -u speckle git clone https://github.com/speckleworks/SpeckleViewer.git - you say its deprecated and the Viewer now is in the Admin, so we could probably remove this step - to avoid any confusion or make a comment //if you want old viewer, do this?