ACME+LE is definitely the future.

I've built some custom AspNetCore middleware that completely owns the entire thing. I tried win-acme and other clients but they aren't in the same room of convenience. All I need to provide is the desired hostname to the middleware and ensure traffic destined for that FQDN winds up at the server. HTTP-01 is used to verify, so I don't have to screw with anything other than an A record. If the hostname is null, it issues an IP address certificate instead using Amazon's public IP lookup service to derive the appropriate SAN. Certs are automatically refreshed when they are within 48 hours of expiration, and the actual swap is a X509Certificate2 reference being updated. It's about as trivial as it gets.

None of the libraries/CLI tools I attempted support anything like this experience. This is what originally put me off to the ecosystem and the idea of short lived certificates. The automation can't just be "sufficient". It needs to be "fucking incredible". $12.95/yr is not that expensive to me if the alternative is getting sucked into hours and hours of someone else's idea of a good time.