https://exposure.co getting SSL certificate from Let's Encrypt on-the-fly

patrik.photos.txt

$ curl -s -v https://patrik.photos
* Rebuilt URL to: https://patrik.photos/
*   Trying 100.25.9.126...
* TCP_NODELAY set
* Connected to patrik.photos (100.25.9.126) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=patrik.photos
*  start date: Apr 25 20:28:35 2019 GMT
*  expire date: Jul 24 20:28:35 2019 GMT
*  subjectAltName: host "patrik.photos" matched cert's "patrik.photos"
*  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*  SSL certificate verify ok.
> GET / HTTP/1.1
> Host: patrik.photos
> User-Agent: curl/7.54.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: openresty
< Date: Thu, 25 Apr 2019 21:28:39 GMT
< Content-Type: text/html; charset=utf-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Vary: Accept-Encoding
< Status: 200 OK
< X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< Content-Language: en
< X-FRAME-OPTIONS: ALLOWALL
< ETag: W/"dd188fbad4a7b1d6190c96126800cd50"
< Cache-Control: max-age=0, private, must-revalidate
< Set-Cookie: _exposure_session=3dca9bfb8e1f92110d6794ceb0baaf02; domain=.exposure.co; path=/; expires=Thu, 09 May 2019 21:28:39 -0000; HttpOnly
< X-Request-Id: 22a530ed-3897-465e-a2f0-9e5a453e82b9
< X-Runtime: 0.738887
< Strict-Transport-Security: max-age=0; includeSubdomains