Add support for mod_md
Automatic Let's Encrypt certs are an option with mod_md which is available from Apache 2.4.30, Debian Stretch has Apache 2.4.25 and Debian Buster has Apache 2.4.38 and Apache 2.4.41 in backports.
See the Apache documentation and the GitHub documentation.