letsencrypt.sh is great. It has easy support for existing CSRs and can do dns-01 verification (i.e. making sure you control the domain via a DNS secret rather an http get path&#x2F;secret). I wrote up a usage tutorial for the latter with Route53 here <a href="https:&#x2F;&#x2F;blog.boldlisting.com&#x2F;free-ssl-certificates-without-placing-a-file-on-your-server-using-aws-route53-31035f8fca14" rel="nofollow">https:&#x2F;&#x2F;blog.boldlisting.com&#x2F;free-ssl-certificates-without-p...</a>