The Vaultwarden container listens on HTTP port 80 by default, does not handle TLS certificates directly, and typically a reverse proxy is deployed at the front end for TLS termination.