I can't recommend acme-tiny enough. I have cron calling a very short script every month that uses openssl & acme-tiny to renew the cert, and by adding a 'location' block to my nginx configs, they don't need to be touched during renovation.