Couldnt find guidance for configuring auto SSL renewal without a webservice/reverse proxy, so this experience may help,. its not step by step but does show whats possible, to prevent early throw in of towel. The certifytheweb client seems very robust and flexible and supports export in Embys PKCS#12 format with a few authorities and a multitude of dynamics dns providors (for validating certificate requests on domains). I used Dynu DDNS and ZeroSSL. and this guide for getting started