I'm pretty sure there are letsencrypt windows clients. Which you can run every week to make sure they auto-renew. And you could do this as well by running the VM regularly, automatically.
The point of letsencrypt is to have auto-renewed certificates. It's intended to force you to automate the process.