That's not always an option. For example, when I was looking into it for google app engine, I came across these directions: http://blog.seafuj.com/lets-encrypt-on-google-app-engine and http://igorartamonov.com/2015/12/lets-encrypt-ssl-google-app...

That's not so bad if you have to do it once a year or better yet once every two years, but I'm not doing that every 3 months.

There's an issue open to allow for the process to be automated, hopefully by the next time I need to renew it'll be available. But as it stands today I went with a paid certificate.