[DanielDent]

Here's one approach: https://github.com/DanielDent/docker-nginx-ssl-proxy

I use a temporary self-signed keypair, which then gets replaced when the certificate is issued.