Huge tip: you need a separate http server for the wss server

For years I struggled to launch both a https web server (on port 443) and a wss socket server (on say port 2345) opn the same node.js script.

The solution is simple, you just add (one line of code) a https server specifically for the wss server.

(Indeed, you just make one for each wss server you are operating.)

Hence,

get a letscreate cert:

On the shell create your certs. Stop your webserver for a minute and:
% certbot certonly --standalone

In node.js

const cts = {
    cert: fs.readFileSync("/etc/letsencrypt/-blah-/fullchain.pem"),
    key: fs.readFileSync("/etc/letsencrypt/-blah-/privkey.pem")
}

// create https (443)
app = express()
app.use .. etc etc
app.get .. etc etc
https.createServer(cts, app).listen(443)

// bounce http (80)
const bounce = express()
bounce.get("*", (req, res, next) => {res.status(403)})
appHttpBouncebounce.listen(80)

// create https SPECIFICALLY FOR wss (2345)
let for_2345 = https.createServer(options).listen(2345)
let wss = new WSServer({
    server: for_2345,
    perMessageDeflate: false
})
wss.on( etc etc )

// create https SPECIFICALLY FOR wss (2666)
let for_2666 = https.createServer(options).listen(2666)
let wss_admin = new WSServer({
    server: for_2666,
    perMessageDeflate: false
})
wss_admin.on( etc etc )

And that's how it's done.