yes, only one service. it would be insane to expose the entire host.

you can just get the cert out of band, that's not the hard part. it could be published by the service as a nostr message for example.