The big cloud services offer solutions for that, although with some caveats. AWS for example creates a cert free of charge with automatic renewal, but it won't give out any private keys. So TLS is terminated at their load balancer, which you would have to use to my knowledge. I just hope Amazon is too rich to conduct widespread industrial espionage.

I actually don't know if that works with domains not managed by them, but I believe so.

Sadly, certs from big CAs are pretty expensive these days... Let's encrypt is really awesome service to counter that.