I use jsign and AWS KMS. It's a lot less expensive than a full on HSM or "cloud HSM" service.

There's a lot to it, and expect a ton of a back and forth emails with a CA to get an EV Cert.

Here's some example code for generating the CSR (Certificate signing request) to submit to a CA.

https://github.com/aws-samples/csr-builder-for-kms