+1

+1 

  @LolleQ +1

  @LolleQ 

Where do you want to place the certificate? If you want to secure  machine behind your router, you can setup a NAT rule to this machine (or to a reverse proxy, if you wanna handle different machines) and process LE certificates there. Would that be a solution?

  @SebastianH I thought of using a webserver behind the gateway, comin from the internet. Here you can forward traffic (TCP 80/443) to a reverse proxy which i handling certificates.

I didn't think about the Portal Page. Indeed, a valid certificate makes sense, especially if portal is used for customers. I didn't find a possibility to change the portal URL, so a reverse proxy wouldn't help here. If you could change the URL you could point it as well to a reverse proxy. Then the reverse proxy could handle ssl / certificate and proxy traffic to the omada portal. BUT in this case (Portal Page) I advocate a solution a the controller.