Nginx must key the cert map on $ssl_server_name during handshake, and www-data needs ssl-cert group access to Let's Encrypt files when certificates are loaded via variables.
Co-authored-by: Cursor <cursoragent@cursor.com>
Per-row Issue SSL now runs ssl-issue-tenant.sh for business/customer hosts only, with nginx cert map support, so one broken tenant cannot block others.
Co-authored-by: Cursor <cursoragent@cursor.com>