This, letsencrypt with dns challenge, desec.io to manage the dns records github.com/go-acme/lego or traefik to manage the certificates and do the dns challenges for you.