Well, securely yes.
But if you move from port 80 then the renewals via --webroot will fail.
For that scenario you can turn to --standalone as certbot will then be able to stand there (on port 80) all alone whenever it actually needs to renew your certs.
If I want to change my domain name, should I repeat the process?
I will keep an eye on the log files to check renewals etc. , where can i find them pls?
certbot logs will normally go to the /etc/letsencrypt/letsencrypt.log file.
If you change your domain, you will need to create another certonly cert.
Then point your node.js to those new cert files.
Then delete the old/unused cert.
Use: certbot delete --cert-name {whatever the old cert name is}
You can find the names (and lots more) of your cert with:
certbot certificates
[try that one now]
Thats great - I can see the details. Its has 89 days to expire.
Is there a status command for certbot also ?
? ? ?
What are you looking for?
Just curious, I thought there may be some sort of status page to let user know Certbot settings (i.e. mode)
I think in my situation, I.e. using this server for API (and use port 8080/8089), --standalone would be more suited given the amount of work for --webroot.
Not that I plan to, but is it simple enough to switch from --webroot to --standalone mode?
Hindsight is 20/20!
A lot simpler than the other way around - that's for sure!
--standalone takes care of everything - you only need to get off port 80 and let it do its' thing.
Thanks for your help, really appreciated your support and getting me off the ground 
My pleasure 
(again)
Cheers from Miami 
Do let us know if you run into any trouble with the switch from --webroot to --standalone
[I think you are well versed in this now and will be all right - but, if not, we are always here to help]