v0.16.8 — an nginx block nginx will load

moshcode doh --nginx <name> emitted listen 443 ssl with no ssl_certificate. nginx refuses to load that outright — nginx -t fails and a reload takes every other site on the box down. certbot could not rescue it either: certbot --nginx needs a loadable vhost before it can issue the certificate that would make it loadable. A cycle with no entry point, on exactly the path the emitted comment recommended.

Now emits the port-80 half, which stands on its own; certbot rewrites it in place and owns renewal afterwards. --tls emits the certified form for a host provisioned some other way, with the listener and the certificate emitted together.