If you are behind a NAT and don't have an public IP you can get the certificate using Tailscale. You can run the command tailscale cert

https://tailscale.com/blog/caddy/

https://tailscale.com/kb/1153/enabling-https/