I'm the nth author of an ACME (Let's Encrypt) client. It's a single-binary Go client which you can build and upload to your server. It's designed to work like "make"; you tell it what hostnames you want certificates for, and it tries to satisfy those requirements. It can install a cronjob automatically for autorenewal, and the authorization process doesn't require downtime.

https://github.com/hlandau/acme.t