I use certbot and AWS ACM all the time. CloudFlare offers end to end encryption between your origin server and their edge network as well for free. You can create a server certificate to use between you and CloudFlare