The good news: I made this site secure using Let’s Encrypt.
The bad news: It took lots of swearing. But it was partially my fault, I think, because I got one of the three SSL certificate files mixed up. Oddly, another site worked fine with the automatic setup and did not require futzing.