IPv6 is here to stay so at some point I need to switch to an IPv6 capable solution to manage certs and forward traffic to my LAN side servers.

So I would need three routes:
(1) IPv6 LAN to IPv6 LAN (works already)
(2) IPv6 WWW to IPv6 LAN with * cert
(3) IPv4 WWW to IPv6 LAN with cert *) or fall back to IPv4 WWW to IPv4 LAN which I have running via synology rev proxy

*) route 3: I need a legacy IPv4 route for when I roam among IPv4 only networks.

Can I use HAproxy for 1, 2 and 3?
Does it do wildcard certs with auto renew?
Which domain providers would I choose?
Which pitfalls should I look out for?

Thanks!