Add a reverse proxy in front of the app and configure HTTPS on this proxy. Conveniently, you have Apache running which can happily reverse proxy for you.
As it currently stands, you can't use port 4040 as that's already taken by the app, so unless you can change the app's port or get it to bind to localhost (127.0.0.1 etc) only, then you'll have to run this app on a different port. On that note, if you want to run this app over HTTPS there's no point leaving it still accessible by the insecure HTTP, so it would be better to configure this app to bind to localhost and have it accessible only through the reverse proxy.
You need the
ProxyPass family of configuration options to create a reverse proxy. Here's an incomplete example:
Listen <Public IP address of server>:4040
Protocols h2 h2c http/1.1
# LetsEncrypt certificates (if not configured in another file)
# SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
# SSLCertificateKeyFile /etc/letsencrypt/live/eample.com/privkey.pem
# Include /etc/letsencrypt/options-ssl-apache.conf
ProxyPass / http://127.0.0.1:4040/
ProxyPassReverse / http://127.0.0.1:4040/
Certificates need to have the hostname that the client uses to connect embedded within their Subject Alternative Names extension, therefore as you don't seem to be proposing a different host (
example.com in both cases) you won't need a new certificate.