I am cheating quite a bit. I use AWS Lightsail and I use the bitnami WordPress setup. From there I setup Route53 and run various configuration changes. The image already has letsencrypt so with a couple commands TLS is enabled.
The first is the worst
So this is the first and hopefully worst entry as I try to get all working wonderfully!