Right, Certbot doesn’t work because of an issue with Python, however, it’s easy to generate the certificates elsewhere and inject them into the virtual machine.
> Maybe there's no SSL/TLS library that works on it at all.
There is, but the OS needs to be patched to fix a socket issue (see https://github.com/reactos/reactos/pull/4086 which was never merged because of side effects). The patch does seem to work for my use case and I had actually the site running on HTTPS, but a few hours later it become unresponsive. I didn’t realize that this was probably just due to the HN DOS. I will give HTTPS another shot later today.
Probably doesn't have a letsencrypt client.
Maybe there's no SSL/TLS library that works on it at all.