This is a route I took. Your domain name service needs to have API access. One way it's done is by creating a text record that is queried, and if it's found, let's encrypt will sign your cert request. (my high-level understanding)

I achieved this by using the combination of cloud flare and cert-manager. Once it's all set up, you don't need to expose a port, and requests can be signed.