At the time sandcats took some of that burden off, so you could still self-host without having to wrangle with the cert stuff yourself:

https://docs.sandstorm.io/en/latest/administering/sandcats/

...but yeah, now that let's encrypt does wildcards it'll be easier to do it on your own domain. I'd like to see sandstorm have some nice integration for this in the future.

(sandcats still works of course, and is still a good option to get started if you don't want to mess with DNS and certs right off the bat).