[chme]

Well, you could use certbot (https://github.com/certbot/certbot, see https://certbot.eff.org/docs/using.html#dns-plugins), which is from EFF, so not exactly third party, to do that.