SNI-Triggered Certificate Hook: if a TLS cert is missing, it is fetched on-the-fly from LetsEncrypt.org.