Lets Encrypt is probably the best option. But if you can't use it like me (since I need a wildcard certificate), you should be getting 3-year certificates instead of 1 year ones. At least it'll cut down how often you have to update them.