We are rolling out new automatic TLS infrastructure that does not require members to set up or maintain anything. This means that, for new sites, aliases will get TLS automatically within a few minutes after they are set up and working. This works transparently with all site types, including custom processes and proxies. It doesn’t cost anything, you don’t have to do anything to set it up, and you don’t have to do anything to renew it.
Existing sites that we can detect to be using tls-setup.sh will be migrated to this setup over the next few weeks. That process is completely transparent, and our system attempts to disable the tls-setup.sh scheduled task once it is complete. Once that’s done, we’ll start adding automatic TLS to other existing sites. Our goal is to have TLS available on all aliases of all sites hosted here by the end of June. We will be monitoring the rollout and taking steps to improve the diagnostics and reporting.
This doesn’t affect the ability of sites to be accessed via HTTP, although we (continue to) strongly discourage that.
If this has been enabled for your site, you’ll see the 
emoji next to aliases other than the permanent .nfshost.com alias in the Site Names & Aliases panel on your Site Information panel in the Member Interface.
Our special thanks to Let’s Encrypt, whose service provider integration makes this possible.