Unless you have some reason that you want it to be much harder to configure and that you’ll need to do it again every year then the cert expires, you can instead just run ./discourse-setup and get a free certificate from Let’s Encrypt. The only reason not to that I’m aware of is if you are a bank or something and have a cert that shows that it’s really your company.