I'm the nth author of an ACME (Let's Encrypt) client. It's a single-binary Go client which you can build and upload to your server. It's designed to work like "make"; you tell it what hostnames you want certificates for, and it tries to satisfy those requirements.
It can install a cronjob automatically for autorenewal, and the authorization process doesn't require downtime.
https://github.com/hlandau/acme.t