Apache (is anyone else still using that?) now ships with an official ACME module, which is nice.

Professionally it's been cert-manager.

I haven't paid for a TLS certificate in almost a decade I guess.