[Alacart]

You can do this a variety of ways, most of which boil down to automating a reverse proxy server and generating acme certs. My favorite is Caddy server if you want to build and manage it yourself.

Things get trickier if you want to handle this well for globally distributed servers, since you'll need to have a cluster of reverse proxies near or colocated to your app servers. That needs an anycast IP address to handle A records for apex domains, and usually you want them coordinating to share certs, cache, etc. efficiently. In that situation I'd recommend reaching for a paid service, since there can be a lot to build and maintain.

Source: I built approximated.app, which is a service that does all of that for you.