Apache directly serves ports 80, 443 and 12322 (Adminer). Webmin and Webshell both have their own built in mini-servers but are hidden behind stunnel (sort of like a local proxy). Stunnel listens on ports 12320 & 12321 for external connections and then hands the connection to Webmin/Webshell. Webmin is listening on port 10000, but will only allow connections from the local machine (so stunnel can connect, but you can't connect directly to it.

If you also wish to use your Let's Encrypt cert for Webmin/Webshell, you'll need to reconfigure stunnel to also use your cert. The config can be found at /etc/stunnel/stunnel.conf. Once you have edited the conf file to point to your Let's Encrypt cert, then restart stunnel:

service stunnel4 restart

I hope that clears things up. If you have further questions or feedback, please share. :)