I disagree; I don't think LetsEncrypt is tedious to get set up on your own.

Here's what I recently did when I deployed a new site [0]:

   {dnf,yum,apt-get,whatever} install -y certbot
   certbot certonly --webroot -w /srv/_default -d systemd.software -d www.systemd.software

Certbot went through the registration process in the terminal window. Enter in an email address and read over the terms of service and then it goes and does its thing and finally spits out a success message telling me where the certificate and private key are on the filesystem.

Then just point an nginx configuration file to the two [1] and tell nginx to test and reload its configuration.

    cp nginx.conf /etc/nginx/default.d/systemd.software.nginx.conf
    nginx -t && nginx -s reload

Then, LetsEncrypt will send an email to me notifying me that one or more certificates are about to expire (20 days, 10 days, 1 day ...). I even decided to test that and make sure that works (on a different site a couple years ago) [2]. The certificate can be updated using the certbot-renew service:

    systemctl start certbot-renew.service

Google searches show several examples which put the renewal service on a timer.

That's it! I'm not sure what you think is tedious about that process. Would you care to elaborate?

[0] https://systemd.software/index.html

[1] https://github.com/inetknght/systemd.software/blob/44c584c68...

[2] https://knightoftheinter.net/img/LetsEncrypt_Expiration_Warn...