Fully optional — only contacted when an admin sets a domain and enables ACME in Settings. Islandr's own hand-rolled RFC 8555 client requests, validates (HTTP-01), and renews a certificate directly; no certificate library, no external ACME client (ADR-0019).